if_urtwn.c revision 292174
1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20#include <sys/cdefs.h>
21__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 292174 2015-12-13 21:50:38Z avos $");
22
23/*
24 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
25 */
26
27#include "opt_wlan.h"
28
29#include <sys/param.h>
30#include <sys/sockio.h>
31#include <sys/sysctl.h>
32#include <sys/lock.h>
33#include <sys/mutex.h>
34#include <sys/condvar.h>
35#include <sys/mbuf.h>
36#include <sys/kernel.h>
37#include <sys/socket.h>
38#include <sys/systm.h>
39#include <sys/malloc.h>
40#include <sys/module.h>
41#include <sys/bus.h>
42#include <sys/endian.h>
43#include <sys/linker.h>
44#include <sys/firmware.h>
45#include <sys/kdb.h>
46
47#include <machine/bus.h>
48#include <machine/resource.h>
49#include <sys/rman.h>
50
51#include <net/bpf.h>
52#include <net/if.h>
53#include <net/if_var.h>
54#include <net/if_arp.h>
55#include <net/ethernet.h>
56#include <net/if_dl.h>
57#include <net/if_media.h>
58#include <net/if_types.h>
59
60#include <netinet/in.h>
61#include <netinet/in_systm.h>
62#include <netinet/in_var.h>
63#include <netinet/if_ether.h>
64#include <netinet/ip.h>
65
66#include <net80211/ieee80211_var.h>
67#include <net80211/ieee80211_input.h>
68#include <net80211/ieee80211_regdomain.h>
69#include <net80211/ieee80211_radiotap.h>
70#include <net80211/ieee80211_ratectl.h>
71
72#include <dev/usb/usb.h>
73#include <dev/usb/usbdi.h>
74#include <dev/usb/usb_device.h>
75#include "usbdevs.h"
76
77#define USB_DEBUG_VAR urtwn_debug
78#include <dev/usb/usb_debug.h>
79
80#include <dev/usb/wlan/if_urtwnreg.h>
81#include <dev/usb/wlan/if_urtwnvar.h>
82
83#ifdef USB_DEBUG
84static int urtwn_debug = 0;
85
86SYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
87SYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RWTUN, &urtwn_debug, 0,
88    "Debug level");
89#endif
90
91#define	IEEE80211_HAS_ADDR4(wh)	IEEE80211_IS_DSTODS(wh)
92
93/* various supported device vendors/products */
94static const STRUCT_USB_HOST_ID urtwn_devs[] = {
95#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
96#define	URTWN_RTL8188E_DEV(v,p)	\
97	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
98#define URTWN_RTL8188E  1
99	URTWN_DEV(ABOCOM,	RTL8188CU_1),
100	URTWN_DEV(ABOCOM,	RTL8188CU_2),
101	URTWN_DEV(ABOCOM,	RTL8192CU),
102	URTWN_DEV(ASUS,		RTL8192CU),
103	URTWN_DEV(ASUS,		USBN10NANO),
104	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
105	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
106	URTWN_DEV(AZUREWAVE,	RTL8188CU),
107	URTWN_DEV(BELKIN,	F7D2102),
108	URTWN_DEV(BELKIN,	RTL8188CU),
109	URTWN_DEV(BELKIN,	RTL8192CU),
110	URTWN_DEV(CHICONY,	RTL8188CUS_1),
111	URTWN_DEV(CHICONY,	RTL8188CUS_2),
112	URTWN_DEV(CHICONY,	RTL8188CUS_3),
113	URTWN_DEV(CHICONY,	RTL8188CUS_4),
114	URTWN_DEV(CHICONY,	RTL8188CUS_5),
115	URTWN_DEV(COREGA,	RTL8192CU),
116	URTWN_DEV(DLINK,	RTL8188CU),
117	URTWN_DEV(DLINK,	RTL8192CU_1),
118	URTWN_DEV(DLINK,	RTL8192CU_2),
119	URTWN_DEV(DLINK,	RTL8192CU_3),
120	URTWN_DEV(DLINK,	DWA131B),
121	URTWN_DEV(EDIMAX,	EW7811UN),
122	URTWN_DEV(EDIMAX,	RTL8192CU),
123	URTWN_DEV(FEIXUN,	RTL8188CU),
124	URTWN_DEV(FEIXUN,	RTL8192CU),
125	URTWN_DEV(GUILLEMOT,	HWNUP150),
126	URTWN_DEV(HAWKING,	RTL8192CU),
127	URTWN_DEV(HP3,		RTL8188CU),
128	URTWN_DEV(NETGEAR,	WNA1000M),
129	URTWN_DEV(NETGEAR,	RTL8192CU),
130	URTWN_DEV(NETGEAR4,	RTL8188CU),
131	URTWN_DEV(NOVATECH,	RTL8188CU),
132	URTWN_DEV(PLANEX2,	RTL8188CU_1),
133	URTWN_DEV(PLANEX2,	RTL8188CU_2),
134	URTWN_DEV(PLANEX2,	RTL8188CU_3),
135	URTWN_DEV(PLANEX2,	RTL8188CU_4),
136	URTWN_DEV(PLANEX2,	RTL8188CUS),
137	URTWN_DEV(PLANEX2,	RTL8192CU),
138	URTWN_DEV(REALTEK,	RTL8188CE_0),
139	URTWN_DEV(REALTEK,	RTL8188CE_1),
140	URTWN_DEV(REALTEK,	RTL8188CTV),
141	URTWN_DEV(REALTEK,	RTL8188CU_0),
142	URTWN_DEV(REALTEK,	RTL8188CU_1),
143	URTWN_DEV(REALTEK,	RTL8188CU_2),
144	URTWN_DEV(REALTEK,	RTL8188CU_3),
145	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
146	URTWN_DEV(REALTEK,	RTL8188CUS),
147	URTWN_DEV(REALTEK,	RTL8188RU_1),
148	URTWN_DEV(REALTEK,	RTL8188RU_2),
149	URTWN_DEV(REALTEK,	RTL8188RU_3),
150	URTWN_DEV(REALTEK,	RTL8191CU),
151	URTWN_DEV(REALTEK,	RTL8192CE),
152	URTWN_DEV(REALTEK,	RTL8192CU),
153	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
154	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
155	URTWN_DEV(SITECOMEU,	RTL8192CU),
156	URTWN_DEV(TRENDNET,	RTL8188CU),
157	URTWN_DEV(TRENDNET,	RTL8192CU),
158	URTWN_DEV(ZYXEL,	RTL8192CU),
159	/* URTWN_RTL8188E */
160	URTWN_RTL8188E_DEV(DLINK,	DWA123D1),
161	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
162	URTWN_RTL8188E_DEV(ELECOM,	WDC150SU2M),
163	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
164	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
165#undef URTWN_RTL8188E_DEV
166#undef URTWN_DEV
167};
168
169static device_probe_t	urtwn_match;
170static device_attach_t	urtwn_attach;
171static device_detach_t	urtwn_detach;
172
173static usb_callback_t   urtwn_bulk_tx_callback;
174static usb_callback_t	urtwn_bulk_rx_callback;
175
176static void		urtwn_drain_mbufq(struct urtwn_softc *sc);
177static usb_error_t	urtwn_do_request(struct urtwn_softc *,
178			    struct usb_device_request *, void *);
179static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
180		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
181                    const uint8_t [IEEE80211_ADDR_LEN],
182                    const uint8_t [IEEE80211_ADDR_LEN]);
183static void		urtwn_vap_delete(struct ieee80211vap *);
184static struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
185			    int *);
186static struct mbuf *	urtwn_report_intr(struct usb_xfer *, struct urtwn_data *,
187			    int *, int8_t *);
188static struct mbuf *	urtwn_rxeof(struct urtwn_softc *, uint8_t *, int,
189			    int *, int8_t *);
190static void		urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *,
191			    void *);
192static void		urtwn_txeof(struct urtwn_softc *, struct urtwn_data *,
193			    int);
194static int		urtwn_alloc_list(struct urtwn_softc *,
195			    struct urtwn_data[], int, int);
196static int		urtwn_alloc_rx_list(struct urtwn_softc *);
197static int		urtwn_alloc_tx_list(struct urtwn_softc *);
198static void		urtwn_free_list(struct urtwn_softc *,
199			    struct urtwn_data data[], int);
200static void		urtwn_free_rx_list(struct urtwn_softc *);
201static void		urtwn_free_tx_list(struct urtwn_softc *);
202static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
203static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
204static usb_error_t	urtwn_write_region_1(struct urtwn_softc *, uint16_t,
205			    uint8_t *, int);
206static usb_error_t	urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
207static usb_error_t	urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
208static usb_error_t	urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
209static usb_error_t	urtwn_read_region_1(struct urtwn_softc *, uint16_t,
210			    uint8_t *, int);
211static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
212static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
213static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
214static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
215			    const void *, int);
216static void		urtwn_cmdq_cb(void *, int);
217static int		urtwn_cmd_sleepable(struct urtwn_softc *, const void *,
218			    size_t, CMD_FUNC_PROTO);
219static void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
220			    uint8_t, uint32_t);
221static void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
222			    uint8_t, uint32_t);
223static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
224static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
225			    uint32_t);
226static int		urtwn_efuse_read_next(struct urtwn_softc *, uint8_t *);
227static int		urtwn_efuse_read_data(struct urtwn_softc *, uint8_t *,
228			    uint8_t, uint8_t);
229#ifdef URTWN_DEBUG
230static void		urtwn_dump_rom_contents(struct urtwn_softc *,
231			    uint8_t *, uint16_t);
232#endif
233static int		urtwn_efuse_read(struct urtwn_softc *, uint8_t *,
234			    uint16_t);
235static int		urtwn_efuse_switch_power(struct urtwn_softc *);
236static int		urtwn_read_chipid(struct urtwn_softc *);
237static int		urtwn_read_rom(struct urtwn_softc *);
238static int		urtwn_r88e_read_rom(struct urtwn_softc *);
239static int		urtwn_ra_init(struct urtwn_softc *);
240static void		urtwn_init_beacon(struct urtwn_softc *,
241			    struct urtwn_vap *);
242static int		urtwn_setup_beacon(struct urtwn_softc *,
243			    struct ieee80211_node *);
244static void		urtwn_update_beacon(struct ieee80211vap *, int);
245static int		urtwn_tx_beacon(struct urtwn_softc *sc,
246			    struct urtwn_vap *);
247static void		urtwn_tsf_task_adhoc(void *, int);
248static void		urtwn_tsf_sync_enable(struct urtwn_softc *,
249			    struct ieee80211vap *);
250static void		urtwn_set_led(struct urtwn_softc *, int, int);
251static void		urtwn_set_mode(struct urtwn_softc *, uint8_t);
252static void		urtwn_ibss_recv_mgmt(struct ieee80211_node *,
253			    struct mbuf *, int,
254			    const struct ieee80211_rx_stats *, int, int);
255static int		urtwn_newstate(struct ieee80211vap *,
256			    enum ieee80211_state, int);
257static void		urtwn_watchdog(void *);
258static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
259static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
260static int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
261static int		urtwn_tx_data(struct urtwn_softc *,
262			    struct ieee80211_node *, struct mbuf *,
263			    struct urtwn_data *);
264static void		urtwn_tx_start(struct urtwn_softc *, struct mbuf *,
265			    uint8_t, struct urtwn_data *);
266static int		urtwn_transmit(struct ieee80211com *, struct mbuf *);
267static void		urtwn_start(struct urtwn_softc *);
268static void		urtwn_parent(struct ieee80211com *);
269static int		urtwn_r92c_power_on(struct urtwn_softc *);
270static int		urtwn_r88e_power_on(struct urtwn_softc *);
271static int		urtwn_llt_init(struct urtwn_softc *);
272static void		urtwn_fw_reset(struct urtwn_softc *);
273static void		urtwn_r88e_fw_reset(struct urtwn_softc *);
274static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
275			    const uint8_t *, int);
276static int		urtwn_load_firmware(struct urtwn_softc *);
277static int		urtwn_dma_init(struct urtwn_softc *);
278static int		urtwn_mac_init(struct urtwn_softc *);
279static void		urtwn_bb_init(struct urtwn_softc *);
280static void		urtwn_rf_init(struct urtwn_softc *);
281static void		urtwn_cam_init(struct urtwn_softc *);
282static void		urtwn_pa_bias_init(struct urtwn_softc *);
283static void		urtwn_rxfilter_init(struct urtwn_softc *);
284static void		urtwn_edca_init(struct urtwn_softc *);
285static void		urtwn_write_txpower(struct urtwn_softc *, int,
286			    uint16_t[]);
287static void		urtwn_get_txpower(struct urtwn_softc *, int,
288		      	    struct ieee80211_channel *,
289			    struct ieee80211_channel *, uint16_t[]);
290static void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
291		      	    struct ieee80211_channel *,
292			    struct ieee80211_channel *, uint16_t[]);
293static void		urtwn_set_txpower(struct urtwn_softc *,
294		    	    struct ieee80211_channel *,
295			    struct ieee80211_channel *);
296static void		urtwn_set_rx_bssid_all(struct urtwn_softc *, int);
297static void		urtwn_set_gain(struct urtwn_softc *, uint8_t);
298static void		urtwn_scan_start(struct ieee80211com *);
299static void		urtwn_scan_end(struct ieee80211com *);
300static void		urtwn_set_channel(struct ieee80211com *);
301static int		urtwn_wme_update(struct ieee80211com *);
302static void		urtwn_set_promisc(struct urtwn_softc *);
303static void		urtwn_update_promisc(struct ieee80211com *);
304static void		urtwn_update_mcast(struct ieee80211com *);
305static struct ieee80211_node *urtwn_r88e_node_alloc(struct ieee80211vap *,
306			    const uint8_t mac[IEEE80211_ADDR_LEN]);
307static void		urtwn_r88e_newassoc(struct ieee80211_node *, int);
308static void		urtwn_r88e_node_free(struct ieee80211_node *);
309static void		urtwn_set_chan(struct urtwn_softc *,
310		    	    struct ieee80211_channel *,
311			    struct ieee80211_channel *);
312static void		urtwn_iq_calib(struct urtwn_softc *);
313static void		urtwn_lc_calib(struct urtwn_softc *);
314static int		urtwn_init(struct urtwn_softc *);
315static void		urtwn_stop(struct urtwn_softc *);
316static void		urtwn_abort_xfers(struct urtwn_softc *);
317static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
318			    const struct ieee80211_bpf_params *);
319static void		urtwn_ms_delay(struct urtwn_softc *);
320
321/* Aliases. */
322#define	urtwn_bb_write	urtwn_write_4
323#define urtwn_bb_read	urtwn_read_4
324
325static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
326	[URTWN_BULK_RX] = {
327		.type = UE_BULK,
328		.endpoint = UE_ADDR_ANY,
329		.direction = UE_DIR_IN,
330		.bufsize = URTWN_RXBUFSZ,
331		.flags = {
332			.pipe_bof = 1,
333			.short_xfer_ok = 1
334		},
335		.callback = urtwn_bulk_rx_callback,
336	},
337	[URTWN_BULK_TX_BE] = {
338		.type = UE_BULK,
339		.endpoint = 0x03,
340		.direction = UE_DIR_OUT,
341		.bufsize = URTWN_TXBUFSZ,
342		.flags = {
343			.ext_buffer = 1,
344			.pipe_bof = 1,
345			.force_short_xfer = 1
346		},
347		.callback = urtwn_bulk_tx_callback,
348		.timeout = URTWN_TX_TIMEOUT,	/* ms */
349	},
350	[URTWN_BULK_TX_BK] = {
351		.type = UE_BULK,
352		.endpoint = 0x03,
353		.direction = UE_DIR_OUT,
354		.bufsize = URTWN_TXBUFSZ,
355		.flags = {
356			.ext_buffer = 1,
357			.pipe_bof = 1,
358			.force_short_xfer = 1,
359		},
360		.callback = urtwn_bulk_tx_callback,
361		.timeout = URTWN_TX_TIMEOUT,	/* ms */
362	},
363	[URTWN_BULK_TX_VI] = {
364		.type = UE_BULK,
365		.endpoint = 0x02,
366		.direction = UE_DIR_OUT,
367		.bufsize = URTWN_TXBUFSZ,
368		.flags = {
369			.ext_buffer = 1,
370			.pipe_bof = 1,
371			.force_short_xfer = 1
372		},
373		.callback = urtwn_bulk_tx_callback,
374		.timeout = URTWN_TX_TIMEOUT,	/* ms */
375	},
376	[URTWN_BULK_TX_VO] = {
377		.type = UE_BULK,
378		.endpoint = 0x02,
379		.direction = UE_DIR_OUT,
380		.bufsize = URTWN_TXBUFSZ,
381		.flags = {
382			.ext_buffer = 1,
383			.pipe_bof = 1,
384			.force_short_xfer = 1
385		},
386		.callback = urtwn_bulk_tx_callback,
387		.timeout = URTWN_TX_TIMEOUT,	/* ms */
388	},
389};
390
391static const struct wme_to_queue {
392	uint16_t reg;
393	uint8_t qid;
394} wme2queue[WME_NUM_AC] = {
395	{ R92C_EDCA_BE_PARAM, URTWN_BULK_TX_BE},
396	{ R92C_EDCA_BK_PARAM, URTWN_BULK_TX_BK},
397	{ R92C_EDCA_VI_PARAM, URTWN_BULK_TX_VI},
398	{ R92C_EDCA_VO_PARAM, URTWN_BULK_TX_VO}
399};
400
401static int
402urtwn_match(device_t self)
403{
404	struct usb_attach_arg *uaa = device_get_ivars(self);
405
406	if (uaa->usb_mode != USB_MODE_HOST)
407		return (ENXIO);
408	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
409		return (ENXIO);
410	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
411		return (ENXIO);
412
413	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
414}
415
416static int
417urtwn_attach(device_t self)
418{
419	struct usb_attach_arg *uaa = device_get_ivars(self);
420	struct urtwn_softc *sc = device_get_softc(self);
421	struct ieee80211com *ic = &sc->sc_ic;
422	uint8_t bands;
423	int error;
424
425	device_set_usb_desc(self);
426	sc->sc_udev = uaa->device;
427	sc->sc_dev = self;
428	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
429		sc->chip |= URTWN_CHIP_88E;
430
431	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
432	    MTX_NETWORK_LOCK, MTX_DEF);
433	URTWN_CMDQ_LOCK_INIT(sc);
434	URTWN_NT_LOCK_INIT(sc);
435	callout_init(&sc->sc_watchdog_ch, 0);
436	mbufq_init(&sc->sc_snd, ifqmaxlen);
437
438	sc->sc_iface_index = URTWN_IFACE_INDEX;
439	error = usbd_transfer_setup(uaa->device, &sc->sc_iface_index,
440	    sc->sc_xfer, urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
441	if (error) {
442		device_printf(self, "could not allocate USB transfers, "
443		    "err=%s\n", usbd_errstr(error));
444		goto detach;
445	}
446
447	URTWN_LOCK(sc);
448
449	error = urtwn_read_chipid(sc);
450	if (error) {
451		device_printf(sc->sc_dev, "unsupported test chip\n");
452		URTWN_UNLOCK(sc);
453		goto detach;
454	}
455
456	/* Determine number of Tx/Rx chains. */
457	if (sc->chip & URTWN_CHIP_92C) {
458		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
459		sc->nrxchains = 2;
460	} else {
461		sc->ntxchains = 1;
462		sc->nrxchains = 1;
463	}
464
465	if (sc->chip & URTWN_CHIP_88E)
466		error = urtwn_r88e_read_rom(sc);
467	else
468		error = urtwn_read_rom(sc);
469	if (error != 0) {
470		device_printf(sc->sc_dev, "%s: cannot read rom, error %d\n",
471		    __func__, error);
472		URTWN_UNLOCK(sc);
473		goto detach;
474	}
475
476	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
477	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
478	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
479	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
480	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
481	    "8188CUS", sc->ntxchains, sc->nrxchains);
482
483	URTWN_UNLOCK(sc);
484
485	ic->ic_softc = sc;
486	ic->ic_name = device_get_nameunit(self);
487	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
488	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
489
490	/* set device capabilities */
491	ic->ic_caps =
492		  IEEE80211_C_STA		/* station mode */
493		| IEEE80211_C_MONITOR		/* monitor mode */
494		| IEEE80211_C_IBSS		/* adhoc mode */
495		| IEEE80211_C_HOSTAP		/* hostap mode */
496		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
497		| IEEE80211_C_SHSLOT		/* short slot time supported */
498		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
499		| IEEE80211_C_WPA		/* 802.11i */
500		| IEEE80211_C_WME		/* 802.11e */
501		;
502
503	bands = 0;
504	setbit(&bands, IEEE80211_MODE_11B);
505	setbit(&bands, IEEE80211_MODE_11G);
506	ieee80211_init_channels(ic, NULL, &bands);
507
508	ieee80211_ifattach(ic);
509	ic->ic_raw_xmit = urtwn_raw_xmit;
510	ic->ic_scan_start = urtwn_scan_start;
511	ic->ic_scan_end = urtwn_scan_end;
512	ic->ic_set_channel = urtwn_set_channel;
513	ic->ic_transmit = urtwn_transmit;
514	ic->ic_parent = urtwn_parent;
515	ic->ic_vap_create = urtwn_vap_create;
516	ic->ic_vap_delete = urtwn_vap_delete;
517	ic->ic_wme.wme_update = urtwn_wme_update;
518	ic->ic_update_promisc = urtwn_update_promisc;
519	ic->ic_update_mcast = urtwn_update_mcast;
520	if (sc->chip & URTWN_CHIP_88E) {
521		ic->ic_node_alloc = urtwn_r88e_node_alloc;
522		ic->ic_newassoc = urtwn_r88e_newassoc;
523		sc->sc_node_free = ic->ic_node_free;
524		ic->ic_node_free = urtwn_r88e_node_free;
525	}
526
527	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
528	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
529	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
530	    URTWN_RX_RADIOTAP_PRESENT);
531
532	TASK_INIT(&sc->cmdq_task, 0, urtwn_cmdq_cb, sc);
533
534	if (bootverbose)
535		ieee80211_announce(ic);
536
537	return (0);
538
539detach:
540	urtwn_detach(self);
541	return (ENXIO);			/* failure */
542}
543
544static int
545urtwn_detach(device_t self)
546{
547	struct urtwn_softc *sc = device_get_softc(self);
548	struct ieee80211com *ic = &sc->sc_ic;
549	unsigned int x;
550
551	/* Prevent further ioctls. */
552	URTWN_LOCK(sc);
553	sc->sc_flags |= URTWN_DETACHED;
554	URTWN_UNLOCK(sc);
555
556	urtwn_stop(sc);
557
558	callout_drain(&sc->sc_watchdog_ch);
559
560	/* stop all USB transfers */
561	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
562
563	/* Prevent further allocations from RX/TX data lists. */
564	URTWN_LOCK(sc);
565	STAILQ_INIT(&sc->sc_tx_active);
566	STAILQ_INIT(&sc->sc_tx_inactive);
567	STAILQ_INIT(&sc->sc_tx_pending);
568
569	STAILQ_INIT(&sc->sc_rx_active);
570	STAILQ_INIT(&sc->sc_rx_inactive);
571	URTWN_UNLOCK(sc);
572
573	/* drain USB transfers */
574	for (x = 0; x != URTWN_N_TRANSFER; x++)
575		usbd_transfer_drain(sc->sc_xfer[x]);
576
577	/* Free data buffers. */
578	URTWN_LOCK(sc);
579	urtwn_free_tx_list(sc);
580	urtwn_free_rx_list(sc);
581	URTWN_UNLOCK(sc);
582
583	if (ic->ic_softc == sc) {
584		ieee80211_draintask(ic, &sc->cmdq_task);
585		ieee80211_ifdetach(ic);
586	}
587
588	URTWN_NT_LOCK_DESTROY(sc);
589	URTWN_CMDQ_LOCK_DESTROY(sc);
590	mtx_destroy(&sc->sc_mtx);
591
592	return (0);
593}
594
595static void
596urtwn_drain_mbufq(struct urtwn_softc *sc)
597{
598	struct mbuf *m;
599	struct ieee80211_node *ni;
600	URTWN_ASSERT_LOCKED(sc);
601	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
602		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
603		m->m_pkthdr.rcvif = NULL;
604		ieee80211_free_node(ni);
605		m_freem(m);
606	}
607}
608
609static usb_error_t
610urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
611    void *data)
612{
613	usb_error_t err;
614	int ntries = 10;
615
616	URTWN_ASSERT_LOCKED(sc);
617
618	while (ntries--) {
619		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
620		    req, data, 0, NULL, 250 /* ms */);
621		if (err == 0)
622			break;
623
624		DPRINTFN(1, "Control request failed, %s (retrying)\n",
625		    usbd_errstr(err));
626		usb_pause_mtx(&sc->sc_mtx, hz / 100);
627	}
628	return (err);
629}
630
631static struct ieee80211vap *
632urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
633    enum ieee80211_opmode opmode, int flags,
634    const uint8_t bssid[IEEE80211_ADDR_LEN],
635    const uint8_t mac[IEEE80211_ADDR_LEN])
636{
637	struct urtwn_softc *sc = ic->ic_softc;
638	struct urtwn_vap *uvp;
639	struct ieee80211vap *vap;
640
641	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
642		return (NULL);
643
644	uvp = malloc(sizeof(struct urtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
645	vap = &uvp->vap;
646	/* enable s/w bmiss handling for sta mode */
647
648	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
649	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
650		/* out of memory */
651		free(uvp, M_80211_VAP);
652		return (NULL);
653	}
654
655	if (opmode == IEEE80211_M_HOSTAP || opmode == IEEE80211_M_IBSS)
656		urtwn_init_beacon(sc, uvp);
657
658	/* override state transition machine */
659	uvp->newstate = vap->iv_newstate;
660	vap->iv_newstate = urtwn_newstate;
661	vap->iv_update_beacon = urtwn_update_beacon;
662	if (opmode == IEEE80211_M_IBSS) {
663		uvp->recv_mgmt = vap->iv_recv_mgmt;
664		vap->iv_recv_mgmt = urtwn_ibss_recv_mgmt;
665		TASK_INIT(&uvp->tsf_task_adhoc, 0, urtwn_tsf_task_adhoc, vap);
666	}
667
668	if (URTWN_CHIP_HAS_RATECTL(sc))
669		ieee80211_ratectl_init(vap);
670	/* complete setup */
671	ieee80211_vap_attach(vap, ieee80211_media_change,
672	    ieee80211_media_status, mac);
673	ic->ic_opmode = opmode;
674	return (vap);
675}
676
677static void
678urtwn_vap_delete(struct ieee80211vap *vap)
679{
680	struct ieee80211com *ic = vap->iv_ic;
681	struct urtwn_softc *sc = ic->ic_softc;
682	struct urtwn_vap *uvp = URTWN_VAP(vap);
683
684	if (uvp->bcn_mbuf != NULL)
685		m_freem(uvp->bcn_mbuf);
686	if (vap->iv_opmode == IEEE80211_M_IBSS)
687		ieee80211_draintask(ic, &uvp->tsf_task_adhoc);
688	if (URTWN_CHIP_HAS_RATECTL(sc))
689		ieee80211_ratectl_deinit(vap);
690	ieee80211_vap_detach(vap);
691	free(uvp, M_80211_VAP);
692}
693
694static struct mbuf *
695urtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
696{
697	struct ieee80211com *ic = &sc->sc_ic;
698	struct ieee80211_frame *wh;
699	struct mbuf *m;
700	struct r92c_rx_stat *stat;
701	uint32_t rxdw0, rxdw3;
702	uint8_t rate;
703	int8_t rssi = 0;
704	int infosz;
705
706	/*
707	 * don't pass packets to the ieee80211 framework if the driver isn't
708	 * RUNNING.
709	 */
710	if (!(sc->sc_flags & URTWN_RUNNING))
711		return (NULL);
712
713	stat = (struct r92c_rx_stat *)buf;
714	rxdw0 = le32toh(stat->rxdw0);
715	rxdw3 = le32toh(stat->rxdw3);
716
717	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
718		/*
719		 * This should not happen since we setup our Rx filter
720		 * to not receive these frames.
721		 */
722		counter_u64_add(ic->ic_ierrors, 1);
723		return (NULL);
724	}
725	if (pktlen < sizeof(struct ieee80211_frame_ack) ||
726	    pktlen > MCLBYTES) {
727		counter_u64_add(ic->ic_ierrors, 1);
728		return (NULL);
729	}
730
731	rate = MS(rxdw3, R92C_RXDW3_RATE);
732	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
733
734	/* Get RSSI from PHY status descriptor if present. */
735	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
736		if (sc->chip & URTWN_CHIP_88E)
737			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
738		else
739			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
740		/* Update our average RSSI. */
741		urtwn_update_avgrssi(sc, rate, rssi);
742	}
743
744	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
745	if (m == NULL) {
746		device_printf(sc->sc_dev, "could not create RX mbuf\n");
747		return (NULL);
748	}
749
750	/* Finalize mbuf. */
751	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
752	memcpy(mtod(m, uint8_t *), wh, pktlen);
753	m->m_pkthdr.len = m->m_len = pktlen;
754
755	if (ieee80211_radiotap_active(ic)) {
756		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
757
758		tap->wr_flags = 0;
759		/* Map HW rate index to 802.11 rate. */
760		if (!(rxdw3 & R92C_RXDW3_HT)) {
761			tap->wr_rate = ridx2rate[rate];
762		} else if (rate >= 12) {	/* MCS0~15. */
763			/* Bit 7 set means HT MCS instead of rate. */
764			tap->wr_rate = 0x80 | (rate - 12);
765		}
766		tap->wr_dbm_antsignal = rssi;
767		tap->wr_dbm_antnoise = URTWN_NOISE_FLOOR;
768	}
769
770	*rssi_p = rssi;
771
772	return (m);
773}
774
775static struct mbuf *
776urtwn_report_intr(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
777    int8_t *nf)
778{
779	struct urtwn_softc *sc = data->sc;
780	struct ieee80211com *ic = &sc->sc_ic;
781	struct r92c_rx_stat *stat;
782	uint8_t *buf;
783	int len;
784
785	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
786
787	if (len < sizeof(*stat)) {
788		counter_u64_add(ic->ic_ierrors, 1);
789		return (NULL);
790	}
791
792	buf = data->buf;
793	stat = (struct r92c_rx_stat *)buf;
794
795	if (sc->chip & URTWN_CHIP_88E) {
796		int report_sel = MS(le32toh(stat->rxdw3), R88E_RXDW3_RPT);
797
798		switch (report_sel) {
799		case R88E_RXDW3_RPT_RX:
800			return (urtwn_rxeof(sc, buf, len, rssi, nf));
801		case R88E_RXDW3_RPT_TX1:
802			urtwn_r88e_ratectl_tx_complete(sc, &stat[1]);
803			break;
804		default:
805			DPRINTFN(7, "case %d was not handled\n", report_sel);
806			break;
807		}
808	} else
809		return (urtwn_rxeof(sc, buf, len, rssi, nf));
810
811	return (NULL);
812}
813
814static struct mbuf *
815urtwn_rxeof(struct urtwn_softc *sc, uint8_t *buf, int len, int *rssi,
816    int8_t *nf)
817{
818	struct r92c_rx_stat *stat;
819	struct mbuf *m, *m0 = NULL, *prevm = NULL;
820	uint32_t rxdw0;
821	int totlen, pktlen, infosz, npkts;
822
823	/* Get the number of encapsulated frames. */
824	stat = (struct r92c_rx_stat *)buf;
825	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
826	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
827
828	/* Process all of them. */
829	while (npkts-- > 0) {
830		if (len < sizeof(*stat))
831			break;
832		stat = (struct r92c_rx_stat *)buf;
833		rxdw0 = le32toh(stat->rxdw0);
834
835		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
836		if (pktlen == 0)
837			break;
838
839		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
840
841		/* Make sure everything fits in xfer. */
842		totlen = sizeof(*stat) + infosz + pktlen;
843		if (totlen > len)
844			break;
845
846		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
847		if (m0 == NULL)
848			m0 = m;
849		if (prevm == NULL)
850			prevm = m;
851		else {
852			prevm->m_next = m;
853			prevm = m;
854		}
855
856		/* Next chunk is 128-byte aligned. */
857		totlen = (totlen + 127) & ~127;
858		buf += totlen;
859		len -= totlen;
860	}
861
862	return (m0);
863}
864
865static void
866urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *sc, void *arg)
867{
868	struct r88e_tx_rpt_ccx *rpt = arg;
869	struct ieee80211vap *vap;
870	struct ieee80211_node *ni;
871	uint8_t macid;
872	int ntries;
873
874	macid = MS(rpt->rptb1, R88E_RPTB1_MACID);
875	ntries = MS(rpt->rptb2, R88E_RPTB2_RETRY_CNT);
876
877	URTWN_NT_LOCK(sc);
878	ni = sc->node_list[macid];
879	if (ni != NULL) {
880		vap = ni->ni_vap;
881
882		if (rpt->rptb1 & R88E_RPTB1_PKT_OK) {
883			ieee80211_ratectl_tx_complete(vap, ni,
884			    IEEE80211_RATECTL_TX_SUCCESS, &ntries, NULL);
885		} else {
886			ieee80211_ratectl_tx_complete(vap, ni,
887			    IEEE80211_RATECTL_TX_FAILURE, &ntries, NULL);
888		}
889	} else
890		DPRINTFN(8, "macid %d, ni is NULL\n", macid);
891	URTWN_NT_UNLOCK(sc);
892}
893
894static void
895urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
896{
897	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
898	struct ieee80211com *ic = &sc->sc_ic;
899	struct ieee80211_frame_min *wh;
900	struct ieee80211_node *ni;
901	struct mbuf *m = NULL, *next;
902	struct urtwn_data *data;
903	int8_t nf;
904	int rssi = 1;
905
906	URTWN_ASSERT_LOCKED(sc);
907
908	switch (USB_GET_STATE(xfer)) {
909	case USB_ST_TRANSFERRED:
910		data = STAILQ_FIRST(&sc->sc_rx_active);
911		if (data == NULL)
912			goto tr_setup;
913		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
914		m = urtwn_report_intr(xfer, data, &rssi, &nf);
915		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
916		/* FALLTHROUGH */
917	case USB_ST_SETUP:
918tr_setup:
919		data = STAILQ_FIRST(&sc->sc_rx_inactive);
920		if (data == NULL) {
921			KASSERT(m == NULL, ("mbuf isn't NULL"));
922			return;
923		}
924		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
925		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
926		usbd_xfer_set_frame_data(xfer, 0, data->buf,
927		    usbd_xfer_max_len(xfer));
928		usbd_transfer_submit(xfer);
929
930		/*
931		 * To avoid LOR we should unlock our private mutex here to call
932		 * ieee80211_input() because here is at the end of a USB
933		 * callback and safe to unlock.
934		 */
935		URTWN_UNLOCK(sc);
936		while (m != NULL) {
937			next = m->m_next;
938			m->m_next = NULL;
939			wh = mtod(m, struct ieee80211_frame_min *);
940			if (m->m_len >= sizeof(*wh))
941				ni = ieee80211_find_rxnode(ic, wh);
942			else
943				ni = NULL;
944			nf = URTWN_NOISE_FLOOR;
945			if (ni != NULL) {
946				(void)ieee80211_input(ni, m, rssi - nf, nf);
947				ieee80211_free_node(ni);
948			} else {
949				(void)ieee80211_input_all(ic, m, rssi - nf,
950				    nf);
951			}
952			m = next;
953		}
954		URTWN_LOCK(sc);
955		break;
956	default:
957		/* needs it to the inactive queue due to a error. */
958		data = STAILQ_FIRST(&sc->sc_rx_active);
959		if (data != NULL) {
960			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
961			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
962		}
963		if (error != USB_ERR_CANCELLED) {
964			usbd_xfer_set_stall(xfer);
965			counter_u64_add(ic->ic_ierrors, 1);
966			goto tr_setup;
967		}
968		break;
969	}
970}
971
972static void
973urtwn_txeof(struct urtwn_softc *sc, struct urtwn_data *data, int status)
974{
975
976	URTWN_ASSERT_LOCKED(sc);
977
978	if (data->ni != NULL)	/* not a beacon frame */
979		ieee80211_tx_complete(data->ni, data->m, status);
980
981	data->ni = NULL;
982	data->m = NULL;
983
984	sc->sc_txtimer = 0;
985
986	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
987}
988
989static int
990urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
991    int ndata, int maxsz)
992{
993	int i, error;
994
995	for (i = 0; i < ndata; i++) {
996		struct urtwn_data *dp = &data[i];
997		dp->sc = sc;
998		dp->m = NULL;
999		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1000		if (dp->buf == NULL) {
1001			device_printf(sc->sc_dev,
1002			    "could not allocate buffer\n");
1003			error = ENOMEM;
1004			goto fail;
1005		}
1006		dp->ni = NULL;
1007	}
1008
1009	return (0);
1010fail:
1011	urtwn_free_list(sc, data, ndata);
1012	return (error);
1013}
1014
1015static int
1016urtwn_alloc_rx_list(struct urtwn_softc *sc)
1017{
1018        int error, i;
1019
1020	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
1021	    URTWN_RXBUFSZ);
1022	if (error != 0)
1023		return (error);
1024
1025	STAILQ_INIT(&sc->sc_rx_active);
1026	STAILQ_INIT(&sc->sc_rx_inactive);
1027
1028	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
1029		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1030
1031	return (0);
1032}
1033
1034static int
1035urtwn_alloc_tx_list(struct urtwn_softc *sc)
1036{
1037	int error, i;
1038
1039	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
1040	    URTWN_TXBUFSZ);
1041	if (error != 0)
1042		return (error);
1043
1044	STAILQ_INIT(&sc->sc_tx_active);
1045	STAILQ_INIT(&sc->sc_tx_inactive);
1046	STAILQ_INIT(&sc->sc_tx_pending);
1047
1048	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
1049		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1050
1051	return (0);
1052}
1053
1054static void
1055urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
1056{
1057	int i;
1058
1059	for (i = 0; i < ndata; i++) {
1060		struct urtwn_data *dp = &data[i];
1061
1062		if (dp->buf != NULL) {
1063			free(dp->buf, M_USBDEV);
1064			dp->buf = NULL;
1065		}
1066		if (dp->ni != NULL) {
1067			ieee80211_free_node(dp->ni);
1068			dp->ni = NULL;
1069		}
1070	}
1071}
1072
1073static void
1074urtwn_free_rx_list(struct urtwn_softc *sc)
1075{
1076	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
1077}
1078
1079static void
1080urtwn_free_tx_list(struct urtwn_softc *sc)
1081{
1082	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
1083}
1084
1085static void
1086urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
1087{
1088	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1089	struct urtwn_data *data;
1090
1091	URTWN_ASSERT_LOCKED(sc);
1092
1093	switch (USB_GET_STATE(xfer)){
1094	case USB_ST_TRANSFERRED:
1095		data = STAILQ_FIRST(&sc->sc_tx_active);
1096		if (data == NULL)
1097			goto tr_setup;
1098		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1099		urtwn_txeof(sc, data, 0);
1100		/* FALLTHROUGH */
1101	case USB_ST_SETUP:
1102tr_setup:
1103		data = STAILQ_FIRST(&sc->sc_tx_pending);
1104		if (data == NULL) {
1105			DPRINTF("%s: empty pending queue\n", __func__);
1106			goto finish;
1107		}
1108		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
1109		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
1110		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1111		usbd_transfer_submit(xfer);
1112		break;
1113	default:
1114		data = STAILQ_FIRST(&sc->sc_tx_active);
1115		if (data == NULL)
1116			goto tr_setup;
1117		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1118		urtwn_txeof(sc, data, 1);
1119		if (error != USB_ERR_CANCELLED) {
1120			usbd_xfer_set_stall(xfer);
1121			goto tr_setup;
1122		}
1123		break;
1124	}
1125finish:
1126	/* Kick-start more transmit */
1127	urtwn_start(sc);
1128}
1129
1130static struct urtwn_data *
1131_urtwn_getbuf(struct urtwn_softc *sc)
1132{
1133	struct urtwn_data *bf;
1134
1135	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1136	if (bf != NULL)
1137		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1138	else
1139		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
1140	return (bf);
1141}
1142
1143static struct urtwn_data *
1144urtwn_getbuf(struct urtwn_softc *sc)
1145{
1146        struct urtwn_data *bf;
1147
1148	URTWN_ASSERT_LOCKED(sc);
1149
1150	bf = _urtwn_getbuf(sc);
1151	if (bf == NULL)
1152		DPRINTF("%s: stop queue\n", __func__);
1153	return (bf);
1154}
1155
1156static usb_error_t
1157urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1158    int len)
1159{
1160	usb_device_request_t req;
1161
1162	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1163	req.bRequest = R92C_REQ_REGS;
1164	USETW(req.wValue, addr);
1165	USETW(req.wIndex, 0);
1166	USETW(req.wLength, len);
1167	return (urtwn_do_request(sc, &req, buf));
1168}
1169
1170static usb_error_t
1171urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1172{
1173	return (urtwn_write_region_1(sc, addr, &val, sizeof(val)));
1174}
1175
1176static usb_error_t
1177urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1178{
1179	val = htole16(val);
1180	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1181}
1182
1183static usb_error_t
1184urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1185{
1186	val = htole32(val);
1187	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1188}
1189
1190static usb_error_t
1191urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1192    int len)
1193{
1194	usb_device_request_t req;
1195
1196	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1197	req.bRequest = R92C_REQ_REGS;
1198	USETW(req.wValue, addr);
1199	USETW(req.wIndex, 0);
1200	USETW(req.wLength, len);
1201	return (urtwn_do_request(sc, &req, buf));
1202}
1203
1204static uint8_t
1205urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1206{
1207	uint8_t val;
1208
1209	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1210		return (0xff);
1211	return (val);
1212}
1213
1214static uint16_t
1215urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1216{
1217	uint16_t val;
1218
1219	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1220		return (0xffff);
1221	return (le16toh(val));
1222}
1223
1224static uint32_t
1225urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1226{
1227	uint32_t val;
1228
1229	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1230		return (0xffffffff);
1231	return (le32toh(val));
1232}
1233
1234static int
1235urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1236{
1237	struct r92c_fw_cmd cmd;
1238	usb_error_t error;
1239	int ntries;
1240
1241	/* Wait for current FW box to be empty. */
1242	for (ntries = 0; ntries < 100; ntries++) {
1243		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1244			break;
1245		urtwn_ms_delay(sc);
1246	}
1247	if (ntries == 100) {
1248		device_printf(sc->sc_dev,
1249		    "could not send firmware command\n");
1250		return (ETIMEDOUT);
1251	}
1252	memset(&cmd, 0, sizeof(cmd));
1253	cmd.id = id;
1254	if (len > 3)
1255		cmd.id |= R92C_CMD_FLAG_EXT;
1256	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1257	memcpy(cmd.msg, buf, len);
1258
1259	/* Write the first word last since that will trigger the FW. */
1260	error = urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1261	    (uint8_t *)&cmd + 4, 2);
1262	if (error != USB_ERR_NORMAL_COMPLETION)
1263		return (EIO);
1264	error = urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1265	    (uint8_t *)&cmd + 0, 4);
1266	if (error != USB_ERR_NORMAL_COMPLETION)
1267		return (EIO);
1268
1269	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1270	return (0);
1271}
1272
1273static void
1274urtwn_cmdq_cb(void *arg, int pending)
1275{
1276	struct urtwn_softc *sc = arg;
1277	struct urtwn_cmdq *item;
1278
1279	/*
1280	 * Device must be powered on (via urtwn_power_on())
1281	 * before any command may be sent.
1282	 */
1283	URTWN_LOCK(sc);
1284	if (!(sc->sc_flags & URTWN_RUNNING)) {
1285		URTWN_UNLOCK(sc);
1286		return;
1287	}
1288
1289	URTWN_CMDQ_LOCK(sc);
1290	while (sc->cmdq[sc->cmdq_first].func != NULL) {
1291		item = &sc->cmdq[sc->cmdq_first];
1292		sc->cmdq_first = (sc->cmdq_first + 1) % URTWN_CMDQ_SIZE;
1293		URTWN_CMDQ_UNLOCK(sc);
1294
1295		item->func(sc, &item->data);
1296
1297		URTWN_CMDQ_LOCK(sc);
1298		memset(item, 0, sizeof (*item));
1299	}
1300	URTWN_CMDQ_UNLOCK(sc);
1301	URTWN_UNLOCK(sc);
1302}
1303
1304static int
1305urtwn_cmd_sleepable(struct urtwn_softc *sc, const void *ptr, size_t len,
1306    CMD_FUNC_PROTO)
1307{
1308	struct ieee80211com *ic = &sc->sc_ic;
1309
1310	KASSERT(len <= sizeof(union sec_param), ("buffer overflow"));
1311
1312	URTWN_CMDQ_LOCK(sc);
1313	if (sc->cmdq[sc->cmdq_last].func != NULL) {
1314		device_printf(sc->sc_dev, "%s: cmdq overflow\n", __func__);
1315		URTWN_CMDQ_UNLOCK(sc);
1316
1317		return (EAGAIN);
1318	}
1319
1320	if (ptr != NULL)
1321		memcpy(&sc->cmdq[sc->cmdq_last].data, ptr, len);
1322	sc->cmdq[sc->cmdq_last].func = func;
1323	sc->cmdq_last = (sc->cmdq_last + 1) % URTWN_CMDQ_SIZE;
1324	URTWN_CMDQ_UNLOCK(sc);
1325
1326	ieee80211_runtask(ic, &sc->cmdq_task);
1327
1328	return (0);
1329}
1330
1331static __inline void
1332urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1333{
1334
1335	sc->sc_rf_write(sc, chain, addr, val);
1336}
1337
1338static void
1339urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1340    uint32_t val)
1341{
1342	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1343	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1344	    SM(R92C_LSSI_PARAM_DATA, val));
1345}
1346
1347static void
1348urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1349uint32_t val)
1350{
1351	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1352	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1353	    SM(R92C_LSSI_PARAM_DATA, val));
1354}
1355
1356static uint32_t
1357urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1358{
1359	uint32_t reg[R92C_MAX_CHAINS], val;
1360
1361	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1362	if (chain != 0)
1363		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1364
1365	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1366	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1367	urtwn_ms_delay(sc);
1368
1369	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1370	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1371	    R92C_HSSI_PARAM2_READ_EDGE);
1372	urtwn_ms_delay(sc);
1373
1374	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1375	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1376	urtwn_ms_delay(sc);
1377
1378	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1379		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1380	else
1381		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1382	return (MS(val, R92C_LSSI_READBACK_DATA));
1383}
1384
1385static int
1386urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1387{
1388	usb_error_t error;
1389	int ntries;
1390
1391	error = urtwn_write_4(sc, R92C_LLT_INIT,
1392	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1393	    SM(R92C_LLT_INIT_ADDR, addr) |
1394	    SM(R92C_LLT_INIT_DATA, data));
1395	if (error != USB_ERR_NORMAL_COMPLETION)
1396		return (EIO);
1397	/* Wait for write operation to complete. */
1398	for (ntries = 0; ntries < 20; ntries++) {
1399		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1400		    R92C_LLT_INIT_OP_NO_ACTIVE)
1401			return (0);
1402		urtwn_ms_delay(sc);
1403	}
1404	return (ETIMEDOUT);
1405}
1406
1407static int
1408urtwn_efuse_read_next(struct urtwn_softc *sc, uint8_t *val)
1409{
1410	uint32_t reg;
1411	usb_error_t error;
1412	int ntries;
1413
1414	if (sc->last_rom_addr >= URTWN_EFUSE_MAX_LEN)
1415		return (EFAULT);
1416
1417	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1418	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, sc->last_rom_addr);
1419	reg &= ~R92C_EFUSE_CTRL_VALID;
1420
1421	error = urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1422	if (error != USB_ERR_NORMAL_COMPLETION)
1423		return (EIO);
1424	/* Wait for read operation to complete. */
1425	for (ntries = 0; ntries < 100; ntries++) {
1426		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1427		if (reg & R92C_EFUSE_CTRL_VALID)
1428			break;
1429		urtwn_ms_delay(sc);
1430	}
1431	if (ntries == 100) {
1432		device_printf(sc->sc_dev,
1433		    "could not read efuse byte at address 0x%x\n",
1434		    sc->last_rom_addr);
1435		return (ETIMEDOUT);
1436	}
1437
1438	*val = MS(reg, R92C_EFUSE_CTRL_DATA);
1439	sc->last_rom_addr++;
1440
1441	return (0);
1442}
1443
1444static int
1445urtwn_efuse_read_data(struct urtwn_softc *sc, uint8_t *rom, uint8_t off,
1446    uint8_t msk)
1447{
1448	uint8_t reg;
1449	int i, error;
1450
1451	for (i = 0; i < 4; i++) {
1452		if (msk & (1 << i))
1453			continue;
1454		error = urtwn_efuse_read_next(sc, &reg);
1455		if (error != 0)
1456			return (error);
1457		DPRINTF("rom[0x%03X] == 0x%02X\n", off * 8 + i * 2, reg);
1458		rom[off * 8 + i * 2 + 0] = reg;
1459
1460		error = urtwn_efuse_read_next(sc, &reg);
1461		if (error != 0)
1462			return (error);
1463		DPRINTF("rom[0x%03X] == 0x%02X\n", off * 8 + i * 2 + 1, reg);
1464		rom[off * 8 + i * 2 + 1] = reg;
1465	}
1466
1467	return (0);
1468}
1469
1470#ifdef URTWN_DEBUG
1471static void
1472urtwn_dump_rom_contents(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1473{
1474	int i;
1475
1476	/* Dump ROM contents. */
1477	device_printf(sc->sc_dev, "%s:", __func__);
1478	for (i = 0; i < size; i++) {
1479		if (i % 32 == 0)
1480			printf("\n%03X: ", i);
1481		else if (i % 4 == 0)
1482			printf(" ");
1483
1484		printf("%02X", rom[i]);
1485	}
1486	printf("\n");
1487}
1488#endif
1489
1490static int
1491urtwn_efuse_read(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1492{
1493#define URTWN_CHK(res) do {	\
1494	if ((error = res) != 0)	\
1495		goto end;	\
1496} while(0)
1497	uint8_t msk, off, reg;
1498	int error;
1499
1500	URTWN_CHK(urtwn_efuse_switch_power(sc));
1501
1502	/* Read full ROM image. */
1503	sc->last_rom_addr = 0;
1504	memset(rom, 0xff, size);
1505
1506	URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1507	while (reg != 0xff) {
1508		/* check for extended header */
1509		if ((sc->chip & URTWN_CHIP_88E) && (reg & 0x1f) == 0x0f) {
1510			off = reg >> 5;
1511			URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1512
1513			if ((reg & 0x0f) != 0x0f)
1514				off = ((reg & 0xf0) >> 1) | off;
1515			else
1516				continue;
1517		} else
1518			off = reg >> 4;
1519		msk = reg & 0xf;
1520
1521		URTWN_CHK(urtwn_efuse_read_data(sc, rom, off, msk));
1522		URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1523	}
1524
1525end:
1526
1527#ifdef URTWN_DEBUG
1528	if (urtwn_debug >= 2)
1529		urtwn_dump_rom_contents(sc, rom, size);
1530#endif
1531
1532	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1533
1534	if (error != 0) {
1535		device_printf(sc->sc_dev, "%s: error while reading ROM\n",
1536		    __func__);
1537	}
1538
1539	return (error);
1540#undef URTWN_CHK
1541}
1542
1543static int
1544urtwn_efuse_switch_power(struct urtwn_softc *sc)
1545{
1546	usb_error_t error;
1547	uint32_t reg;
1548
1549	error = urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1550	if (error != USB_ERR_NORMAL_COMPLETION)
1551		return (EIO);
1552
1553	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1554	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1555		error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1556		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1557		if (error != USB_ERR_NORMAL_COMPLETION)
1558			return (EIO);
1559	}
1560	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1561	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1562		error = urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1563		    reg | R92C_SYS_FUNC_EN_ELDR);
1564		if (error != USB_ERR_NORMAL_COMPLETION)
1565			return (EIO);
1566	}
1567	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1568	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1569	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1570		error = urtwn_write_2(sc, R92C_SYS_CLKR,
1571		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1572		if (error != USB_ERR_NORMAL_COMPLETION)
1573			return (EIO);
1574	}
1575
1576	return (0);
1577}
1578
1579static int
1580urtwn_read_chipid(struct urtwn_softc *sc)
1581{
1582	uint32_t reg;
1583
1584	if (sc->chip & URTWN_CHIP_88E)
1585		return (0);
1586
1587	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1588	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1589		return (EIO);
1590
1591	if (reg & R92C_SYS_CFG_TYPE_92C) {
1592		sc->chip |= URTWN_CHIP_92C;
1593		/* Check if it is a castrated 8192C. */
1594		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1595		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1596		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1597			sc->chip |= URTWN_CHIP_92C_1T2R;
1598	}
1599	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1600		sc->chip |= URTWN_CHIP_UMC;
1601		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1602			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1603	}
1604	return (0);
1605}
1606
1607static int
1608urtwn_read_rom(struct urtwn_softc *sc)
1609{
1610	struct r92c_rom *rom = &sc->rom.r92c_rom;
1611	int error;
1612
1613	/* Read full ROM image. */
1614	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(*rom));
1615	if (error != 0)
1616		return (error);
1617
1618	/* XXX Weird but this is what the vendor driver does. */
1619	sc->last_rom_addr = 0x1fa;
1620	error = urtwn_efuse_read_next(sc, &sc->pa_setting);
1621	if (error != 0)
1622		return (error);
1623	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1624
1625	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1626
1627	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1628	DPRINTF("regulatory type=%d\n", sc->regulatory);
1629	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1630
1631	sc->sc_rf_write = urtwn_r92c_rf_write;
1632	sc->sc_power_on = urtwn_r92c_power_on;
1633
1634	return (0);
1635}
1636
1637static int
1638urtwn_r88e_read_rom(struct urtwn_softc *sc)
1639{
1640	uint8_t *rom = sc->rom.r88e_rom;
1641	uint16_t addr;
1642	int error, i;
1643
1644	error = urtwn_efuse_read(sc, rom, sizeof(sc->rom.r88e_rom));
1645	if (error != 0)
1646		return (error);
1647
1648	addr = 0x10;
1649	for (i = 0; i < 6; i++)
1650		sc->cck_tx_pwr[i] = rom[addr++];
1651	for (i = 0; i < 5; i++)
1652		sc->ht40_tx_pwr[i] = rom[addr++];
1653	sc->bw20_tx_pwr_diff = (rom[addr] & 0xf0) >> 4;
1654	if (sc->bw20_tx_pwr_diff & 0x08)
1655		sc->bw20_tx_pwr_diff |= 0xf0;
1656	sc->ofdm_tx_pwr_diff = (rom[addr] & 0xf);
1657	if (sc->ofdm_tx_pwr_diff & 0x08)
1658		sc->ofdm_tx_pwr_diff |= 0xf0;
1659	sc->regulatory = MS(rom[0xc1], R92C_ROM_RF1_REGULATORY);
1660	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, &rom[0xd7]);
1661
1662	sc->sc_rf_write = urtwn_r88e_rf_write;
1663	sc->sc_power_on = urtwn_r88e_power_on;
1664
1665	return (0);
1666}
1667
1668/*
1669 * Initialize rate adaptation in firmware.
1670 */
1671static int
1672urtwn_ra_init(struct urtwn_softc *sc)
1673{
1674	struct ieee80211com *ic = &sc->sc_ic;
1675	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1676	struct ieee80211_node *ni;
1677	struct ieee80211_rateset *rs;
1678	struct r92c_fw_cmd_macid_cfg cmd;
1679	uint32_t rates, basicrates;
1680	uint8_t mode;
1681	int maxrate, maxbasicrate, error, i, j;
1682
1683	ni = ieee80211_ref_node(vap->iv_bss);
1684	rs = &ni->ni_rates;
1685
1686	/* Get normal and basic rates mask. */
1687	rates = basicrates = 0;
1688	maxrate = maxbasicrate = 0;
1689	for (i = 0; i < rs->rs_nrates; i++) {
1690		/* Convert 802.11 rate to HW rate index. */
1691		for (j = 0; j < nitems(ridx2rate); j++)
1692			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) ==
1693			    ridx2rate[j])
1694				break;
1695		if (j == nitems(ridx2rate))	/* Unknown rate, skip. */
1696			continue;
1697		rates |= 1 << j;
1698		if (j > maxrate)
1699			maxrate = j;
1700		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1701			basicrates |= 1 << j;
1702			if (j > maxbasicrate)
1703				maxbasicrate = j;
1704		}
1705	}
1706	if (ic->ic_curmode == IEEE80211_MODE_11B)
1707		mode = R92C_RAID_11B;
1708	else
1709		mode = R92C_RAID_11BG;
1710	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1711	    mode, rates, basicrates);
1712
1713	/* Set rates mask for group addressed frames. */
1714	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1715	cmd.mask = htole32(mode << 28 | basicrates);
1716	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1717	if (error != 0) {
1718		ieee80211_free_node(ni);
1719		device_printf(sc->sc_dev,
1720		    "could not add broadcast station\n");
1721		return (error);
1722	}
1723	/* Set initial MRR rate. */
1724	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1725	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1726	    maxbasicrate);
1727
1728	/* Set rates mask for unicast frames. */
1729	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1730	cmd.mask = htole32(mode << 28 | rates);
1731	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1732	if (error != 0) {
1733		ieee80211_free_node(ni);
1734		device_printf(sc->sc_dev, "could not add BSS station\n");
1735		return (error);
1736	}
1737	/* Set initial MRR rate. */
1738	DPRINTF("maxrate=%d\n", maxrate);
1739	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1740	    maxrate);
1741
1742	/* Indicate highest supported rate. */
1743	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1744	ieee80211_free_node(ni);
1745
1746	return (0);
1747}
1748
1749static void
1750urtwn_init_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
1751{
1752	struct r92c_tx_desc *txd = &uvp->bcn_desc;
1753
1754	txd->txdw0 = htole32(
1755	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) | R92C_TXDW0_BMCAST |
1756	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1757	txd->txdw1 = htole32(
1758	    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BEACON) |
1759	    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1760
1761	if (sc->chip & URTWN_CHIP_88E) {
1762		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
1763		txd->txdseq |= htole16(R88E_TXDSEQ_HWSEQ_EN);
1764	} else {
1765		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
1766		txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
1767	}
1768
1769	txd->txdw4 = htole32(R92C_TXDW4_DRVRATE);
1770	txd->txdw5 = htole32(SM(R92C_TXDW5_DATARATE, URTWN_RIDX_CCK1));
1771}
1772
1773static int
1774urtwn_setup_beacon(struct urtwn_softc *sc, struct ieee80211_node *ni)
1775{
1776 	struct ieee80211vap *vap = ni->ni_vap;
1777	struct urtwn_vap *uvp = URTWN_VAP(vap);
1778	struct mbuf *m;
1779	int error;
1780
1781	URTWN_ASSERT_LOCKED(sc);
1782
1783	if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1784		return (EINVAL);
1785
1786	m = ieee80211_beacon_alloc(ni);
1787	if (m == NULL) {
1788		device_printf(sc->sc_dev,
1789		    "%s: could not allocate beacon frame\n", __func__);
1790		return (ENOMEM);
1791	}
1792
1793	if (uvp->bcn_mbuf != NULL)
1794		m_freem(uvp->bcn_mbuf);
1795
1796	uvp->bcn_mbuf = m;
1797
1798	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
1799		return (error);
1800
1801	/* XXX bcnq stuck workaround */
1802	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
1803		return (error);
1804
1805	return (0);
1806}
1807
1808static void
1809urtwn_update_beacon(struct ieee80211vap *vap, int item)
1810{
1811	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
1812	struct urtwn_vap *uvp = URTWN_VAP(vap);
1813	struct ieee80211_beacon_offsets *bo = &vap->iv_bcn_off;
1814	struct ieee80211_node *ni = vap->iv_bss;
1815	int mcast = 0;
1816
1817	URTWN_LOCK(sc);
1818	if (uvp->bcn_mbuf == NULL) {
1819		uvp->bcn_mbuf = ieee80211_beacon_alloc(ni);
1820		if (uvp->bcn_mbuf == NULL) {
1821			device_printf(sc->sc_dev,
1822			    "%s: could not allocate beacon frame\n", __func__);
1823			URTWN_UNLOCK(sc);
1824			return;
1825		}
1826	}
1827	URTWN_UNLOCK(sc);
1828
1829	if (item == IEEE80211_BEACON_TIM)
1830		mcast = 1;	/* XXX */
1831
1832	setbit(bo->bo_flags, item);
1833	ieee80211_beacon_update(ni, uvp->bcn_mbuf, mcast);
1834
1835	URTWN_LOCK(sc);
1836	urtwn_tx_beacon(sc, uvp);
1837	URTWN_UNLOCK(sc);
1838}
1839
1840/*
1841 * Push a beacon frame into the chip. Beacon will
1842 * be repeated by the chip every R92C_BCN_INTERVAL.
1843 */
1844static int
1845urtwn_tx_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
1846{
1847	struct r92c_tx_desc *desc = &uvp->bcn_desc;
1848	struct urtwn_data *bf;
1849
1850	URTWN_ASSERT_LOCKED(sc);
1851
1852	bf = urtwn_getbuf(sc);
1853	if (bf == NULL)
1854		return (ENOMEM);
1855
1856	memcpy(bf->buf, desc, sizeof(*desc));
1857	urtwn_tx_start(sc, uvp->bcn_mbuf, IEEE80211_FC0_TYPE_MGT, bf);
1858
1859	sc->sc_txtimer = 5;
1860	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1861
1862	return (0);
1863}
1864
1865static void
1866urtwn_tsf_task_adhoc(void *arg, int pending)
1867{
1868	struct ieee80211vap *vap = arg;
1869	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
1870	struct ieee80211_node *ni;
1871	uint32_t reg;
1872
1873	URTWN_LOCK(sc);
1874	ni = ieee80211_ref_node(vap->iv_bss);
1875	reg = urtwn_read_1(sc, R92C_BCN_CTRL);
1876
1877	/* Accept beacons with the same BSSID. */
1878	urtwn_set_rx_bssid_all(sc, 0);
1879
1880	/* Enable synchronization. */
1881	reg &= ~R92C_BCN_CTRL_DIS_TSF_UDT0;
1882	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
1883
1884	/* Synchronize. */
1885	usb_pause_mtx(&sc->sc_mtx, hz * ni->ni_intval * 5 / 1000);
1886
1887	/* Disable synchronization. */
1888	reg |= R92C_BCN_CTRL_DIS_TSF_UDT0;
1889	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
1890
1891	/* Remove beacon filter. */
1892	urtwn_set_rx_bssid_all(sc, 1);
1893
1894	/* Enable beaconing. */
1895	urtwn_write_1(sc, R92C_MBID_NUM,
1896	    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
1897	reg |= R92C_BCN_CTRL_EN_BCN;
1898
1899	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
1900	ieee80211_free_node(ni);
1901	URTWN_UNLOCK(sc);
1902}
1903
1904static void
1905urtwn_tsf_sync_enable(struct urtwn_softc *sc, struct ieee80211vap *vap)
1906{
1907	struct ieee80211com *ic = &sc->sc_ic;
1908	struct urtwn_vap *uvp = URTWN_VAP(vap);
1909
1910	/* Reset TSF. */
1911	urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
1912
1913	switch (vap->iv_opmode) {
1914	case IEEE80211_M_STA:
1915		/* Enable TSF synchronization. */
1916		urtwn_write_1(sc, R92C_BCN_CTRL,
1917		    urtwn_read_1(sc, R92C_BCN_CTRL) &
1918		    ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1919		break;
1920	case IEEE80211_M_IBSS:
1921		ieee80211_runtask(ic, &uvp->tsf_task_adhoc);
1922		break;
1923	case IEEE80211_M_HOSTAP:
1924		/* Enable beaconing. */
1925		urtwn_write_1(sc, R92C_MBID_NUM,
1926		    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
1927		urtwn_write_1(sc, R92C_BCN_CTRL,
1928		    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1929		break;
1930	default:
1931		device_printf(sc->sc_dev, "undefined opmode %d\n",
1932		    vap->iv_opmode);
1933		return;
1934	}
1935}
1936
1937static void
1938urtwn_set_led(struct urtwn_softc *sc, int led, int on)
1939{
1940	uint8_t reg;
1941
1942	if (led == URTWN_LED_LINK) {
1943		if (sc->chip & URTWN_CHIP_88E) {
1944			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
1945			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
1946			if (!on) {
1947				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
1948				urtwn_write_1(sc, R92C_LEDCFG2,
1949				    reg | R92C_LEDCFG0_DIS);
1950				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
1951				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
1952				    0xfe);
1953			}
1954		} else {
1955			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1956			if (!on)
1957				reg |= R92C_LEDCFG0_DIS;
1958			urtwn_write_1(sc, R92C_LEDCFG0, reg);
1959		}
1960		sc->ledlink = on;       /* Save LED state. */
1961	}
1962}
1963
1964static void
1965urtwn_set_mode(struct urtwn_softc *sc, uint8_t mode)
1966{
1967	uint8_t reg;
1968
1969	reg = urtwn_read_1(sc, R92C_MSR);
1970	reg = (reg & ~R92C_MSR_MASK) | mode;
1971	urtwn_write_1(sc, R92C_MSR, reg);
1972}
1973
1974static void
1975urtwn_ibss_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m, int subtype,
1976    const struct ieee80211_rx_stats *rxs,
1977    int rssi, int nf)
1978{
1979	struct ieee80211vap *vap = ni->ni_vap;
1980	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
1981	struct urtwn_vap *uvp = URTWN_VAP(vap);
1982	uint64_t ni_tstamp, curr_tstamp;
1983
1984	uvp->recv_mgmt(ni, m, subtype, rxs, rssi, nf);
1985
1986	if (vap->iv_state == IEEE80211_S_RUN &&
1987	    (subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
1988	    subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) {
1989		ni_tstamp = le64toh(ni->ni_tstamp.tsf);
1990#ifdef D3831
1991		URTWN_LOCK(sc);
1992		urtwn_get_tsf(sc, &curr_tstamp);
1993		URTWN_UNLOCK(sc);
1994		curr_tstamp = le64toh(curr_tstamp);
1995
1996		if (ni_tstamp >= curr_tstamp)
1997			(void) ieee80211_ibss_merge(ni);
1998#else
1999		(void) sc;
2000		(void) curr_tstamp;
2001#endif
2002	}
2003}
2004
2005static int
2006urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2007{
2008	struct urtwn_vap *uvp = URTWN_VAP(vap);
2009	struct ieee80211com *ic = vap->iv_ic;
2010	struct urtwn_softc *sc = ic->ic_softc;
2011	struct ieee80211_node *ni;
2012	enum ieee80211_state ostate;
2013	uint32_t reg;
2014	uint8_t mode;
2015	int error = 0;
2016
2017	ostate = vap->iv_state;
2018	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
2019	    ieee80211_state_name[nstate]);
2020
2021	IEEE80211_UNLOCK(ic);
2022	URTWN_LOCK(sc);
2023	callout_stop(&sc->sc_watchdog_ch);
2024
2025	if (ostate == IEEE80211_S_RUN) {
2026		/* Turn link LED off. */
2027		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2028
2029		/* Set media status to 'No Link'. */
2030		urtwn_set_mode(sc, R92C_MSR_NOLINK);
2031
2032		/* Stop Rx of data frames. */
2033		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
2034
2035		/* Disable TSF synchronization. */
2036		urtwn_write_1(sc, R92C_BCN_CTRL,
2037		    (urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN) |
2038		    R92C_BCN_CTRL_DIS_TSF_UDT0);
2039
2040		/* Disable beaconing. */
2041		urtwn_write_1(sc, R92C_MBID_NUM,
2042		    urtwn_read_1(sc, R92C_MBID_NUM) & ~R92C_MBID_TXBCN_RPT0);
2043
2044		/* Reset TSF. */
2045		urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2046
2047		/* Reset EDCA parameters. */
2048		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
2049		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
2050		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
2051		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
2052	}
2053
2054	switch (nstate) {
2055	case IEEE80211_S_INIT:
2056		/* Turn link LED off. */
2057		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2058		break;
2059	case IEEE80211_S_SCAN:
2060		/* Pause AC Tx queues. */
2061		urtwn_write_1(sc, R92C_TXPAUSE,
2062		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
2063		break;
2064	case IEEE80211_S_AUTH:
2065		urtwn_set_chan(sc, ic->ic_curchan, NULL);
2066		break;
2067	case IEEE80211_S_RUN:
2068		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
2069			/* Turn link LED on. */
2070			urtwn_set_led(sc, URTWN_LED_LINK, 1);
2071			break;
2072		}
2073
2074		ni = ieee80211_ref_node(vap->iv_bss);
2075
2076		if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
2077		    ni->ni_chan == IEEE80211_CHAN_ANYC) {
2078			device_printf(sc->sc_dev,
2079			    "%s: could not move to RUN state\n", __func__);
2080			error = EINVAL;
2081			goto end_run;
2082		}
2083
2084		switch (vap->iv_opmode) {
2085		case IEEE80211_M_STA:
2086			mode = R92C_MSR_INFRA;
2087			break;
2088		case IEEE80211_M_IBSS:
2089			mode = R92C_MSR_ADHOC;
2090			break;
2091		case IEEE80211_M_HOSTAP:
2092			mode = R92C_MSR_AP;
2093			break;
2094		default:
2095			device_printf(sc->sc_dev, "undefined opmode %d\n",
2096			    vap->iv_opmode);
2097			error = EINVAL;
2098			goto end_run;
2099		}
2100
2101		/* Set media status to 'Associated'. */
2102		urtwn_set_mode(sc, mode);
2103
2104		/* Set BSSID. */
2105		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
2106		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
2107
2108		if (ic->ic_curmode == IEEE80211_MODE_11B)
2109			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
2110		else	/* 802.11b/g */
2111			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
2112
2113		/* Enable Rx of data frames. */
2114		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2115
2116		/* Flush all AC queues. */
2117		urtwn_write_1(sc, R92C_TXPAUSE, 0);
2118
2119		/* Set beacon interval. */
2120		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
2121
2122		/* Allow Rx from our BSSID only. */
2123		if (ic->ic_promisc == 0) {
2124			reg = urtwn_read_4(sc, R92C_RCR);
2125
2126			if (vap->iv_opmode != IEEE80211_M_HOSTAP)
2127				reg |= R92C_RCR_CBSSID_DATA;
2128			if (vap->iv_opmode != IEEE80211_M_IBSS)
2129				reg |= R92C_RCR_CBSSID_BCN;
2130
2131			urtwn_write_4(sc, R92C_RCR, reg);
2132		}
2133
2134		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
2135		    vap->iv_opmode == IEEE80211_M_IBSS) {
2136			error = urtwn_setup_beacon(sc, ni);
2137			if (error != 0) {
2138				device_printf(sc->sc_dev,
2139				    "unable to push beacon into the chip, "
2140				    "error %d\n", error);
2141				goto end_run;
2142			}
2143		}
2144
2145		/* Enable TSF synchronization. */
2146		urtwn_tsf_sync_enable(sc, vap);
2147
2148		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
2149		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
2150		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
2151		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
2152		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
2153		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
2154
2155		/* Intialize rate adaptation. */
2156		if (!(sc->chip & URTWN_CHIP_88E))
2157			urtwn_ra_init(sc);
2158		/* Turn link LED on. */
2159		urtwn_set_led(sc, URTWN_LED_LINK, 1);
2160
2161		sc->avg_pwdb = -1;	/* Reset average RSSI. */
2162		/* Reset temperature calibration state machine. */
2163		sc->thcal_state = 0;
2164		sc->thcal_lctemp = 0;
2165
2166end_run:
2167		ieee80211_free_node(ni);
2168		break;
2169	default:
2170		break;
2171	}
2172
2173	URTWN_UNLOCK(sc);
2174	IEEE80211_LOCK(ic);
2175	return (error != 0 ? error : uvp->newstate(vap, nstate, arg));
2176}
2177
2178static void
2179urtwn_watchdog(void *arg)
2180{
2181	struct urtwn_softc *sc = arg;
2182
2183	if (sc->sc_txtimer > 0) {
2184		if (--sc->sc_txtimer == 0) {
2185			device_printf(sc->sc_dev, "device timeout\n");
2186			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
2187			return;
2188		}
2189		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2190	}
2191}
2192
2193static void
2194urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
2195{
2196	int pwdb;
2197
2198	/* Convert antenna signal to percentage. */
2199	if (rssi <= -100 || rssi >= 20)
2200		pwdb = 0;
2201	else if (rssi >= 0)
2202		pwdb = 100;
2203	else
2204		pwdb = 100 + rssi;
2205	if (!(sc->chip & URTWN_CHIP_88E)) {
2206		if (rate <= URTWN_RIDX_CCK11) {
2207			/* CCK gain is smaller than OFDM/MCS gain. */
2208			pwdb += 6;
2209			if (pwdb > 100)
2210				pwdb = 100;
2211			if (pwdb <= 14)
2212				pwdb -= 4;
2213			else if (pwdb <= 26)
2214				pwdb -= 8;
2215			else if (pwdb <= 34)
2216				pwdb -= 6;
2217			else if (pwdb <= 42)
2218				pwdb -= 2;
2219		}
2220	}
2221	if (sc->avg_pwdb == -1)	/* Init. */
2222		sc->avg_pwdb = pwdb;
2223	else if (sc->avg_pwdb < pwdb)
2224		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
2225	else
2226		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
2227	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
2228}
2229
2230static int8_t
2231urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2232{
2233	static const int8_t cckoff[] = { 16, -12, -26, -46 };
2234	struct r92c_rx_phystat *phy;
2235	struct r92c_rx_cck *cck;
2236	uint8_t rpt;
2237	int8_t rssi;
2238
2239	if (rate <= URTWN_RIDX_CCK11) {
2240		cck = (struct r92c_rx_cck *)physt;
2241		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
2242			rpt = (cck->agc_rpt >> 5) & 0x3;
2243			rssi = (cck->agc_rpt & 0x1f) << 1;
2244		} else {
2245			rpt = (cck->agc_rpt >> 6) & 0x3;
2246			rssi = cck->agc_rpt & 0x3e;
2247		}
2248		rssi = cckoff[rpt] - rssi;
2249	} else {	/* OFDM/HT. */
2250		phy = (struct r92c_rx_phystat *)physt;
2251		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2252	}
2253	return (rssi);
2254}
2255
2256static int8_t
2257urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2258{
2259	struct r92c_rx_phystat *phy;
2260	struct r88e_rx_cck *cck;
2261	uint8_t cck_agc_rpt, lna_idx, vga_idx;
2262	int8_t rssi;
2263
2264	rssi = 0;
2265	if (rate <= URTWN_RIDX_CCK11) {
2266		cck = (struct r88e_rx_cck *)physt;
2267		cck_agc_rpt = cck->agc_rpt;
2268		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
2269		vga_idx = cck_agc_rpt & 0x1f;
2270		switch (lna_idx) {
2271		case 7:
2272			if (vga_idx <= 27)
2273				rssi = -100 + 2* (27 - vga_idx);
2274			else
2275				rssi = -100;
2276			break;
2277		case 6:
2278			rssi = -48 + 2 * (2 - vga_idx);
2279			break;
2280		case 5:
2281			rssi = -42 + 2 * (7 - vga_idx);
2282			break;
2283		case 4:
2284			rssi = -36 + 2 * (7 - vga_idx);
2285			break;
2286		case 3:
2287			rssi = -24 + 2 * (7 - vga_idx);
2288			break;
2289		case 2:
2290			rssi = -12 + 2 * (5 - vga_idx);
2291			break;
2292		case 1:
2293			rssi = 8 - (2 * vga_idx);
2294			break;
2295		case 0:
2296			rssi = 14 - (2 * vga_idx);
2297			break;
2298		}
2299		rssi += 6;
2300	} else {	/* OFDM/HT. */
2301		phy = (struct r92c_rx_phystat *)physt;
2302		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2303	}
2304	return (rssi);
2305}
2306
2307static __inline uint8_t
2308rate2ridx(uint8_t rate)
2309{
2310	switch (rate) {
2311	case 12:	return 4;
2312	case 18:	return 5;
2313	case 24:	return 6;
2314	case 36:	return 7;
2315	case 48:	return 8;
2316	case 72:	return 9;
2317	case 96:	return 10;
2318	case 108:	return 11;
2319	case 2:		return 0;
2320	case 4:		return 1;
2321	case 11:	return 2;
2322	case 22:	return 3;
2323	default:	return 0;
2324	}
2325}
2326
2327static int
2328urtwn_tx_data(struct urtwn_softc *sc, struct ieee80211_node *ni,
2329    struct mbuf *m, struct urtwn_data *data)
2330{
2331	const struct ieee80211_txparam *tp;
2332	struct ieee80211com *ic = &sc->sc_ic;
2333	struct ieee80211vap *vap = ni->ni_vap;
2334	struct ieee80211_key *k = NULL;
2335	struct ieee80211_channel *chan;
2336	struct ieee80211_frame *wh;
2337	struct r92c_tx_desc *txd;
2338	uint8_t macid, raid, rate, ridx, subtype, type, tid, qsel;
2339	int hasqos, ismcast;
2340
2341	URTWN_ASSERT_LOCKED(sc);
2342
2343	/*
2344	 * Software crypto.
2345	 */
2346	wh = mtod(m, struct ieee80211_frame *);
2347	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2348	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2349	hasqos = IEEE80211_QOS_HAS_SEQ(wh);
2350	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2351
2352	/* Select TX ring for this frame. */
2353	if (hasqos) {
2354		tid = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2355		tid &= IEEE80211_QOS_TID;
2356	} else
2357		tid = 0;
2358
2359	chan = (ni->ni_chan != IEEE80211_CHAN_ANYC) ?
2360		ni->ni_chan : ic->ic_curchan;
2361	tp = &vap->iv_txparms[ieee80211_chan2mode(chan)];
2362
2363	/* Choose a TX rate index. */
2364	if (type == IEEE80211_FC0_TYPE_MGT)
2365		rate = tp->mgmtrate;
2366	else if (ismcast)
2367		rate = tp->mcastrate;
2368	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2369		rate = tp->ucastrate;
2370	else if (m->m_flags & M_EAPOL)
2371		rate = tp->mgmtrate;
2372	else {
2373		if (URTWN_CHIP_HAS_RATECTL(sc)) {
2374			/* XXX pass pktlen */
2375			(void) ieee80211_ratectl_rate(ni, NULL, 0);
2376			rate = ni->ni_txrate;
2377		} else {
2378			if (ic->ic_curmode != IEEE80211_MODE_11B)
2379				rate = 108;
2380			else
2381				rate = 22;
2382		}
2383	}
2384
2385	ridx = rate2ridx(rate);
2386	if (ic->ic_curmode != IEEE80211_MODE_11B)
2387		raid = R92C_RAID_11BG;
2388	else
2389		raid = R92C_RAID_11B;
2390
2391	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2392		k = ieee80211_crypto_encap(ni, m);
2393		if (k == NULL) {
2394			device_printf(sc->sc_dev,
2395			    "ieee80211_crypto_encap returns NULL.\n");
2396			return (ENOBUFS);
2397		}
2398
2399		/* in case packet header moved, reset pointer */
2400		wh = mtod(m, struct ieee80211_frame *);
2401	}
2402
2403	/* Fill Tx descriptor. */
2404	txd = (struct r92c_tx_desc *)data->buf;
2405	memset(txd, 0, sizeof(*txd));
2406
2407	txd->txdw0 |= htole32(
2408	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
2409	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2410	if (ismcast)
2411		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
2412
2413	if (!ismcast) {
2414		if (sc->chip & URTWN_CHIP_88E) {
2415			struct urtwn_node *un = URTWN_NODE(ni);
2416			macid = un->id;
2417		} else
2418			macid = URTWN_MACID_BSS;
2419
2420		if (type == IEEE80211_FC0_TYPE_DATA) {
2421			qsel = tid % URTWN_MAX_TID;
2422
2423			if (sc->chip & URTWN_CHIP_88E) {
2424				txd->txdw2 |= htole32(
2425				    R88E_TXDW2_AGGBK |
2426				    R88E_TXDW2_CCX_RPT);
2427			} else
2428				txd->txdw1 |= htole32(R92C_TXDW1_AGGBK);
2429
2430			if (ic->ic_flags & IEEE80211_F_USEPROT) {
2431				switch (ic->ic_protmode) {
2432				case IEEE80211_PROT_CTSONLY:
2433					txd->txdw4 |= htole32(
2434					    R92C_TXDW4_CTS2SELF |
2435					    R92C_TXDW4_HWRTSEN);
2436					break;
2437				case IEEE80211_PROT_RTSCTS:
2438					txd->txdw4 |= htole32(
2439					    R92C_TXDW4_RTSEN |
2440					    R92C_TXDW4_HWRTSEN);
2441					break;
2442				default:
2443					break;
2444				}
2445			}
2446			txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
2447			    URTWN_RIDX_OFDM24));
2448			txd->txdw5 |= htole32(0x0001ff00);
2449		} else	/* IEEE80211_FC0_TYPE_MGT */
2450			qsel = R92C_TXDW1_QSEL_MGNT;
2451	} else {
2452		macid = URTWN_MACID_BC;
2453		qsel = R92C_TXDW1_QSEL_MGNT;
2454	}
2455
2456	txd->txdw1 |= htole32(
2457	    SM(R92C_TXDW1_QSEL, qsel) |
2458	    SM(R92C_TXDW1_RAID, raid));
2459
2460	if (sc->chip & URTWN_CHIP_88E)
2461		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, macid));
2462	else
2463		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, macid));
2464
2465	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
2466	/* Force this rate if needed. */
2467	if (URTWN_CHIP_HAS_RATECTL(sc) || ismcast ||
2468	    (m->m_flags & M_EAPOL) || type != IEEE80211_FC0_TYPE_DATA)
2469		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
2470
2471	if (!hasqos) {
2472		/* Use HW sequence numbering for non-QoS frames. */
2473		if (sc->chip & URTWN_CHIP_88E)
2474			txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
2475		else
2476			txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
2477	} else {
2478		/* Set sequence number. */
2479		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
2480	}
2481
2482	if (ieee80211_radiotap_active_vap(vap)) {
2483		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
2484
2485		tap->wt_flags = 0;
2486		if (k != NULL)
2487			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2488		ieee80211_radiotap_tx(vap, m);
2489	}
2490
2491	data->ni = ni;
2492
2493	urtwn_tx_start(sc, m, type, data);
2494
2495	return (0);
2496}
2497
2498static void
2499urtwn_tx_start(struct urtwn_softc *sc, struct mbuf *m, uint8_t type,
2500    struct urtwn_data *data)
2501{
2502	struct usb_xfer *xfer;
2503	struct r92c_tx_desc *txd;
2504	uint16_t ac, sum;
2505	int i, xferlen;
2506
2507	URTWN_ASSERT_LOCKED(sc);
2508
2509	ac = M_WME_GETAC(m);
2510
2511	switch (type) {
2512	case IEEE80211_FC0_TYPE_CTL:
2513	case IEEE80211_FC0_TYPE_MGT:
2514		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
2515		break;
2516	default:
2517		xfer = sc->sc_xfer[wme2queue[ac].qid];
2518		break;
2519	}
2520
2521	txd = (struct r92c_tx_desc *)data->buf;
2522	txd->txdw0 |= htole32(SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len));
2523
2524	/* Compute Tx descriptor checksum. */
2525	sum = 0;
2526	for (i = 0; i < sizeof(*txd) / 2; i++)
2527		sum ^= ((uint16_t *)txd)[i];
2528	txd->txdsum = sum;	/* NB: already little endian. */
2529
2530	xferlen = sizeof(*txd) + m->m_pkthdr.len;
2531	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&txd[1]);
2532
2533	data->buflen = xferlen;
2534	data->m = m;
2535
2536	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
2537	usbd_transfer_start(xfer);
2538}
2539
2540static int
2541urtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
2542{
2543	struct urtwn_softc *sc = ic->ic_softc;
2544	int error;
2545
2546	URTWN_LOCK(sc);
2547	if ((sc->sc_flags & URTWN_RUNNING) == 0) {
2548		URTWN_UNLOCK(sc);
2549		return (ENXIO);
2550	}
2551	error = mbufq_enqueue(&sc->sc_snd, m);
2552	if (error) {
2553		URTWN_UNLOCK(sc);
2554		return (error);
2555	}
2556	urtwn_start(sc);
2557	URTWN_UNLOCK(sc);
2558
2559	return (0);
2560}
2561
2562static void
2563urtwn_start(struct urtwn_softc *sc)
2564{
2565	struct ieee80211_node *ni;
2566	struct mbuf *m;
2567	struct urtwn_data *bf;
2568
2569	URTWN_ASSERT_LOCKED(sc);
2570	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
2571		bf = urtwn_getbuf(sc);
2572		if (bf == NULL) {
2573			mbufq_prepend(&sc->sc_snd, m);
2574			break;
2575		}
2576		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2577		m->m_pkthdr.rcvif = NULL;
2578		if (urtwn_tx_data(sc, ni, m, bf) != 0) {
2579			if_inc_counter(ni->ni_vap->iv_ifp,
2580			    IFCOUNTER_OERRORS, 1);
2581			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
2582			m_freem(m);
2583			ieee80211_free_node(ni);
2584			break;
2585		}
2586		sc->sc_txtimer = 5;
2587		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2588	}
2589}
2590
2591static void
2592urtwn_parent(struct ieee80211com *ic)
2593{
2594	struct urtwn_softc *sc = ic->ic_softc;
2595
2596	URTWN_LOCK(sc);
2597	if (sc->sc_flags & URTWN_DETACHED) {
2598		URTWN_UNLOCK(sc);
2599		return;
2600	}
2601	URTWN_UNLOCK(sc);
2602
2603	if (ic->ic_nrunning > 0) {
2604		if (urtwn_init(sc) != 0) {
2605			struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2606			if (vap != NULL)
2607				ieee80211_stop(vap);
2608		} else
2609			ieee80211_start_all(ic);
2610	} else
2611		urtwn_stop(sc);
2612}
2613
2614static __inline int
2615urtwn_power_on(struct urtwn_softc *sc)
2616{
2617
2618	return sc->sc_power_on(sc);
2619}
2620
2621static int
2622urtwn_r92c_power_on(struct urtwn_softc *sc)
2623{
2624	uint32_t reg;
2625	usb_error_t error;
2626	int ntries;
2627
2628	/* Wait for autoload done bit. */
2629	for (ntries = 0; ntries < 1000; ntries++) {
2630		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
2631			break;
2632		urtwn_ms_delay(sc);
2633	}
2634	if (ntries == 1000) {
2635		device_printf(sc->sc_dev,
2636		    "timeout waiting for chip autoload\n");
2637		return (ETIMEDOUT);
2638	}
2639
2640	/* Unlock ISO/CLK/Power control register. */
2641	error = urtwn_write_1(sc, R92C_RSV_CTRL, 0);
2642	if (error != USB_ERR_NORMAL_COMPLETION)
2643		return (EIO);
2644	/* Move SPS into PWM mode. */
2645	error = urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
2646	if (error != USB_ERR_NORMAL_COMPLETION)
2647		return (EIO);
2648	urtwn_ms_delay(sc);
2649
2650	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
2651	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
2652		error = urtwn_write_1(sc, R92C_LDOV12D_CTRL,
2653		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
2654		if (error != USB_ERR_NORMAL_COMPLETION)
2655			return (EIO);
2656		urtwn_ms_delay(sc);
2657		error = urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
2658		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
2659		    ~R92C_SYS_ISO_CTRL_MD2PP);
2660		if (error != USB_ERR_NORMAL_COMPLETION)
2661			return (EIO);
2662	}
2663
2664	/* Auto enable WLAN. */
2665	error = urtwn_write_2(sc, R92C_APS_FSMCO,
2666	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2667	if (error != USB_ERR_NORMAL_COMPLETION)
2668		return (EIO);
2669	for (ntries = 0; ntries < 1000; ntries++) {
2670		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2671		    R92C_APS_FSMCO_APFM_ONMAC))
2672			break;
2673		urtwn_ms_delay(sc);
2674	}
2675	if (ntries == 1000) {
2676		device_printf(sc->sc_dev,
2677		    "timeout waiting for MAC auto ON\n");
2678		return (ETIMEDOUT);
2679	}
2680
2681	/* Enable radio, GPIO and LED functions. */
2682	error = urtwn_write_2(sc, R92C_APS_FSMCO,
2683	    R92C_APS_FSMCO_AFSM_HSUS |
2684	    R92C_APS_FSMCO_PDN_EN |
2685	    R92C_APS_FSMCO_PFM_ALDN);
2686	if (error != USB_ERR_NORMAL_COMPLETION)
2687		return (EIO);
2688	/* Release RF digital isolation. */
2689	error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
2690	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
2691	if (error != USB_ERR_NORMAL_COMPLETION)
2692		return (EIO);
2693
2694	/* Initialize MAC. */
2695	error = urtwn_write_1(sc, R92C_APSD_CTRL,
2696	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
2697	if (error != USB_ERR_NORMAL_COMPLETION)
2698		return (EIO);
2699	for (ntries = 0; ntries < 200; ntries++) {
2700		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
2701		    R92C_APSD_CTRL_OFF_STATUS))
2702			break;
2703		urtwn_ms_delay(sc);
2704	}
2705	if (ntries == 200) {
2706		device_printf(sc->sc_dev,
2707		    "timeout waiting for MAC initialization\n");
2708		return (ETIMEDOUT);
2709	}
2710
2711	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2712	reg = urtwn_read_2(sc, R92C_CR);
2713	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2714	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2715	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
2716	    R92C_CR_ENSEC;
2717	error = urtwn_write_2(sc, R92C_CR, reg);
2718	if (error != USB_ERR_NORMAL_COMPLETION)
2719		return (EIO);
2720
2721	error = urtwn_write_1(sc, 0xfe10, 0x19);
2722	if (error != USB_ERR_NORMAL_COMPLETION)
2723		return (EIO);
2724	return (0);
2725}
2726
2727static int
2728urtwn_r88e_power_on(struct urtwn_softc *sc)
2729{
2730	uint32_t reg;
2731	usb_error_t error;
2732	int ntries;
2733
2734	/* Wait for power ready bit. */
2735	for (ntries = 0; ntries < 5000; ntries++) {
2736		if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
2737			break;
2738		urtwn_ms_delay(sc);
2739	}
2740	if (ntries == 5000) {
2741		device_printf(sc->sc_dev,
2742		    "timeout waiting for chip power up\n");
2743		return (ETIMEDOUT);
2744	}
2745
2746	/* Reset BB. */
2747	error = urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2748	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
2749	    R92C_SYS_FUNC_EN_BB_GLB_RST));
2750	if (error != USB_ERR_NORMAL_COMPLETION)
2751		return (EIO);
2752
2753	error = urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
2754	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
2755	if (error != USB_ERR_NORMAL_COMPLETION)
2756		return (EIO);
2757
2758	/* Disable HWPDN. */
2759	error = urtwn_write_2(sc, R92C_APS_FSMCO,
2760	    urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
2761	if (error != USB_ERR_NORMAL_COMPLETION)
2762		return (EIO);
2763
2764	/* Disable WL suspend. */
2765	error = urtwn_write_2(sc, R92C_APS_FSMCO,
2766	    urtwn_read_2(sc, R92C_APS_FSMCO) &
2767	    ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
2768	if (error != USB_ERR_NORMAL_COMPLETION)
2769		return (EIO);
2770
2771	error = urtwn_write_2(sc, R92C_APS_FSMCO,
2772	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2773	if (error != USB_ERR_NORMAL_COMPLETION)
2774		return (EIO);
2775	for (ntries = 0; ntries < 5000; ntries++) {
2776		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2777		    R92C_APS_FSMCO_APFM_ONMAC))
2778			break;
2779		urtwn_ms_delay(sc);
2780	}
2781	if (ntries == 5000)
2782		return (ETIMEDOUT);
2783
2784	/* Enable LDO normal mode. */
2785	error = urtwn_write_1(sc, R92C_LPLDO_CTRL,
2786	    urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~0x10);
2787	if (error != USB_ERR_NORMAL_COMPLETION)
2788		return (EIO);
2789
2790	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2791	error = urtwn_write_2(sc, R92C_CR, 0);
2792	if (error != USB_ERR_NORMAL_COMPLETION)
2793		return (EIO);
2794	reg = urtwn_read_2(sc, R92C_CR);
2795	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2796	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2797	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
2798	error = urtwn_write_2(sc, R92C_CR, reg);
2799	if (error != USB_ERR_NORMAL_COMPLETION)
2800		return (EIO);
2801
2802	return (0);
2803}
2804
2805static int
2806urtwn_llt_init(struct urtwn_softc *sc)
2807{
2808	int i, error, page_count, pktbuf_count;
2809
2810	page_count = (sc->chip & URTWN_CHIP_88E) ?
2811	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
2812	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
2813	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
2814
2815	/* Reserve pages [0; page_count]. */
2816	for (i = 0; i < page_count; i++) {
2817		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2818			return (error);
2819	}
2820	/* NB: 0xff indicates end-of-list. */
2821	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
2822		return (error);
2823	/*
2824	 * Use pages [page_count + 1; pktbuf_count - 1]
2825	 * as ring buffer.
2826	 */
2827	for (++i; i < pktbuf_count - 1; i++) {
2828		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2829			return (error);
2830	}
2831	/* Make the last page point to the beginning of the ring buffer. */
2832	error = urtwn_llt_write(sc, i, page_count + 1);
2833	return (error);
2834}
2835
2836static void
2837urtwn_fw_reset(struct urtwn_softc *sc)
2838{
2839	uint16_t reg;
2840	int ntries;
2841
2842	/* Tell 8051 to reset itself. */
2843	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2844
2845	/* Wait until 8051 resets by itself. */
2846	for (ntries = 0; ntries < 100; ntries++) {
2847		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2848		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2849			return;
2850		urtwn_ms_delay(sc);
2851	}
2852	/* Force 8051 reset. */
2853	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2854}
2855
2856static void
2857urtwn_r88e_fw_reset(struct urtwn_softc *sc)
2858{
2859	uint16_t reg;
2860
2861	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2862	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2863	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
2864}
2865
2866static int
2867urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
2868{
2869	uint32_t reg;
2870	usb_error_t error = USB_ERR_NORMAL_COMPLETION;
2871	int off, mlen;
2872
2873	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2874	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2875	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2876
2877	off = R92C_FW_START_ADDR;
2878	while (len > 0) {
2879		if (len > 196)
2880			mlen = 196;
2881		else if (len > 4)
2882			mlen = 4;
2883		else
2884			mlen = 1;
2885		/* XXX fix this deconst */
2886		error = urtwn_write_region_1(sc, off,
2887		    __DECONST(uint8_t *, buf), mlen);
2888		if (error != USB_ERR_NORMAL_COMPLETION)
2889			break;
2890		off += mlen;
2891		buf += mlen;
2892		len -= mlen;
2893	}
2894	return (error);
2895}
2896
2897static int
2898urtwn_load_firmware(struct urtwn_softc *sc)
2899{
2900	const struct firmware *fw;
2901	const struct r92c_fw_hdr *hdr;
2902	const char *imagename;
2903	const u_char *ptr;
2904	size_t len;
2905	uint32_t reg;
2906	int mlen, ntries, page, error;
2907
2908	URTWN_UNLOCK(sc);
2909	/* Read firmware image from the filesystem. */
2910	if (sc->chip & URTWN_CHIP_88E)
2911		imagename = "urtwn-rtl8188eufw";
2912	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2913		    URTWN_CHIP_UMC_A_CUT)
2914		imagename = "urtwn-rtl8192cfwU";
2915	else
2916		imagename = "urtwn-rtl8192cfwT";
2917
2918	fw = firmware_get(imagename);
2919	URTWN_LOCK(sc);
2920	if (fw == NULL) {
2921		device_printf(sc->sc_dev,
2922		    "failed loadfirmware of file %s\n", imagename);
2923		return (ENOENT);
2924	}
2925
2926	len = fw->datasize;
2927
2928	if (len < sizeof(*hdr)) {
2929		device_printf(sc->sc_dev, "firmware too short\n");
2930		error = EINVAL;
2931		goto fail;
2932	}
2933	ptr = fw->data;
2934	hdr = (const struct r92c_fw_hdr *)ptr;
2935	/* Check if there is a valid FW header and skip it. */
2936	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2937	    (le16toh(hdr->signature) >> 4) == 0x88e ||
2938	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2939		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2940		    le16toh(hdr->version), le16toh(hdr->subversion),
2941		    hdr->month, hdr->date, hdr->hour, hdr->minute);
2942		ptr += sizeof(*hdr);
2943		len -= sizeof(*hdr);
2944	}
2945
2946	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
2947		if (sc->chip & URTWN_CHIP_88E)
2948			urtwn_r88e_fw_reset(sc);
2949		else
2950			urtwn_fw_reset(sc);
2951		urtwn_write_1(sc, R92C_MCUFWDL, 0);
2952	}
2953
2954	if (!(sc->chip & URTWN_CHIP_88E)) {
2955		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2956		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2957		    R92C_SYS_FUNC_EN_CPUEN);
2958	}
2959	urtwn_write_1(sc, R92C_MCUFWDL,
2960	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2961	urtwn_write_1(sc, R92C_MCUFWDL + 2,
2962	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2963
2964	/* Reset the FWDL checksum. */
2965	urtwn_write_1(sc, R92C_MCUFWDL,
2966	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
2967
2968	for (page = 0; len > 0; page++) {
2969		mlen = min(len, R92C_FW_PAGE_SIZE);
2970		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2971		if (error != 0) {
2972			device_printf(sc->sc_dev,
2973			    "could not load firmware page\n");
2974			goto fail;
2975		}
2976		ptr += mlen;
2977		len -= mlen;
2978	}
2979	urtwn_write_1(sc, R92C_MCUFWDL,
2980	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2981	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2982
2983	/* Wait for checksum report. */
2984	for (ntries = 0; ntries < 1000; ntries++) {
2985		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2986			break;
2987		urtwn_ms_delay(sc);
2988	}
2989	if (ntries == 1000) {
2990		device_printf(sc->sc_dev,
2991		    "timeout waiting for checksum report\n");
2992		error = ETIMEDOUT;
2993		goto fail;
2994	}
2995
2996	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2997	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2998	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2999	if (sc->chip & URTWN_CHIP_88E)
3000		urtwn_r88e_fw_reset(sc);
3001	/* Wait for firmware readiness. */
3002	for (ntries = 0; ntries < 1000; ntries++) {
3003		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
3004			break;
3005		urtwn_ms_delay(sc);
3006	}
3007	if (ntries == 1000) {
3008		device_printf(sc->sc_dev,
3009		    "timeout waiting for firmware readiness\n");
3010		error = ETIMEDOUT;
3011		goto fail;
3012	}
3013fail:
3014	firmware_put(fw, FIRMWARE_UNLOAD);
3015	return (error);
3016}
3017
3018static int
3019urtwn_dma_init(struct urtwn_softc *sc)
3020{
3021	struct usb_endpoint *ep, *ep_end;
3022	usb_error_t usb_err;
3023	uint32_t reg;
3024	int hashq, hasnq, haslq, nqueues, ntx;
3025	int error, pagecount, npubqpages, nqpages, nrempages, tx_boundary;
3026
3027	/* Initialize LLT table. */
3028	error = urtwn_llt_init(sc);
3029	if (error != 0)
3030		return (error);
3031
3032	/* Determine the number of bulk-out pipes. */
3033	ntx = 0;
3034	ep = sc->sc_udev->endpoints;
3035	ep_end = sc->sc_udev->endpoints + sc->sc_udev->endpoints_max;
3036	for (; ep != ep_end; ep++) {
3037		if ((ep->edesc == NULL) ||
3038		    (ep->iface_index != sc->sc_iface_index))
3039			continue;
3040		if (UE_GET_DIR(ep->edesc->bEndpointAddress) == UE_DIR_OUT)
3041			ntx++;
3042	}
3043	if (ntx == 0) {
3044		device_printf(sc->sc_dev,
3045		    "%d: invalid number of Tx bulk pipes\n", ntx);
3046		return (EIO);
3047	}
3048
3049	/* Get Tx queues to USB endpoints mapping. */
3050	hashq = hasnq = haslq = nqueues = 0;
3051	switch (ntx) {
3052	case 1: hashq = 1; break;
3053	case 2: hashq = hasnq = 1; break;
3054	case 3: case 4: hashq = hasnq = haslq = 1; break;
3055	}
3056	nqueues = hashq + hasnq + haslq;
3057	if (nqueues == 0)
3058		return (EIO);
3059
3060	npubqpages = nqpages = nrempages = pagecount = 0;
3061	if (sc->chip & URTWN_CHIP_88E)
3062		tx_boundary = R88E_TX_PAGE_BOUNDARY;
3063	else {
3064		pagecount = R92C_TX_PAGE_COUNT;
3065		npubqpages = R92C_PUBQ_NPAGES;
3066		tx_boundary = R92C_TX_PAGE_BOUNDARY;
3067	}
3068
3069	/* Set number of pages for normal priority queue. */
3070	if (sc->chip & URTWN_CHIP_88E) {
3071		usb_err = urtwn_write_2(sc, R92C_RQPN_NPQ, 0xd);
3072		if (usb_err != USB_ERR_NORMAL_COMPLETION)
3073			return (EIO);
3074		usb_err = urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
3075		if (usb_err != USB_ERR_NORMAL_COMPLETION)
3076			return (EIO);
3077	} else {
3078		/* Get the number of pages for each queue. */
3079		nqpages = (pagecount - npubqpages) / nqueues;
3080		/*
3081		 * The remaining pages are assigned to the high priority
3082		 * queue.
3083		 */
3084		nrempages = (pagecount - npubqpages) % nqueues;
3085		usb_err = urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
3086		if (usb_err != USB_ERR_NORMAL_COMPLETION)
3087			return (EIO);
3088		usb_err = urtwn_write_4(sc, R92C_RQPN,
3089		    /* Set number of pages for public queue. */
3090		    SM(R92C_RQPN_PUBQ, npubqpages) |
3091		    /* Set number of pages for high priority queue. */
3092		    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
3093		    /* Set number of pages for low priority queue. */
3094		    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
3095		    /* Load values. */
3096		    R92C_RQPN_LD);
3097		if (usb_err != USB_ERR_NORMAL_COMPLETION)
3098			return (EIO);
3099	}
3100
3101	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, tx_boundary);
3102	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3103		return (EIO);
3104	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, tx_boundary);
3105	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3106		return (EIO);
3107	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, tx_boundary);
3108	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3109		return (EIO);
3110	usb_err = urtwn_write_1(sc, R92C_TRXFF_BNDY, tx_boundary);
3111	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3112		return (EIO);
3113	usb_err = urtwn_write_1(sc, R92C_TDECTRL + 1, tx_boundary);
3114	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3115		return (EIO);
3116
3117	/* Set queue to USB pipe mapping. */
3118	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
3119	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
3120	if (nqueues == 1) {
3121		if (hashq)
3122			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
3123		else if (hasnq)
3124			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
3125		else
3126			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
3127	} else if (nqueues == 2) {
3128		/*
3129		 * All 2-endpoints configs have high and normal
3130		 * priority queues.
3131		 */
3132		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
3133	} else
3134		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
3135	usb_err = urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
3136	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3137		return (EIO);
3138
3139	/* Set Tx/Rx transfer page boundary. */
3140	usb_err = urtwn_write_2(sc, R92C_TRXFF_BNDY + 2,
3141	    (sc->chip & URTWN_CHIP_88E) ? 0x23ff : 0x27ff);
3142	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3143		return (EIO);
3144
3145	/* Set Tx/Rx transfer page size. */
3146	usb_err = urtwn_write_1(sc, R92C_PBP,
3147	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
3148	    SM(R92C_PBP_PSTX, R92C_PBP_128));
3149	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3150		return (EIO);
3151
3152	return (0);
3153}
3154
3155static int
3156urtwn_mac_init(struct urtwn_softc *sc)
3157{
3158	usb_error_t error;
3159	int i;
3160
3161	/* Write MAC initialization values. */
3162	if (sc->chip & URTWN_CHIP_88E) {
3163		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
3164			error = urtwn_write_1(sc, rtl8188eu_mac[i].reg,
3165			    rtl8188eu_mac[i].val);
3166			if (error != USB_ERR_NORMAL_COMPLETION)
3167				return (EIO);
3168		}
3169		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
3170	} else {
3171		for (i = 0; i < nitems(rtl8192cu_mac); i++)
3172			error = urtwn_write_1(sc, rtl8192cu_mac[i].reg,
3173			    rtl8192cu_mac[i].val);
3174			if (error != USB_ERR_NORMAL_COMPLETION)
3175				return (EIO);
3176	}
3177
3178	return (0);
3179}
3180
3181static void
3182urtwn_bb_init(struct urtwn_softc *sc)
3183{
3184	const struct urtwn_bb_prog *prog;
3185	uint32_t reg;
3186	uint8_t crystalcap;
3187	int i;
3188
3189	/* Enable BB and RF. */
3190	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
3191	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
3192	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
3193	    R92C_SYS_FUNC_EN_DIO_RF);
3194
3195	if (!(sc->chip & URTWN_CHIP_88E))
3196		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
3197
3198	urtwn_write_1(sc, R92C_RF_CTRL,
3199	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
3200	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3201	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
3202	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
3203
3204	if (!(sc->chip & URTWN_CHIP_88E)) {
3205		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
3206		urtwn_write_1(sc, 0x15, 0xe9);
3207		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
3208	}
3209
3210	/* Select BB programming based on board type. */
3211	if (sc->chip & URTWN_CHIP_88E)
3212		prog = &rtl8188eu_bb_prog;
3213	else if (!(sc->chip & URTWN_CHIP_92C)) {
3214		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
3215			prog = &rtl8188ce_bb_prog;
3216		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
3217			prog = &rtl8188ru_bb_prog;
3218		else
3219			prog = &rtl8188cu_bb_prog;
3220	} else {
3221		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
3222			prog = &rtl8192ce_bb_prog;
3223		else
3224			prog = &rtl8192cu_bb_prog;
3225	}
3226	/* Write BB initialization values. */
3227	for (i = 0; i < prog->count; i++) {
3228		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
3229		urtwn_ms_delay(sc);
3230	}
3231
3232	if (sc->chip & URTWN_CHIP_92C_1T2R) {
3233		/* 8192C 1T only configuration. */
3234		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
3235		reg = (reg & ~0x00000003) | 0x2;
3236		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
3237
3238		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
3239		reg = (reg & ~0x00300033) | 0x00200022;
3240		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
3241
3242		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
3243		reg = (reg & ~0xff000000) | 0x45 << 24;
3244		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
3245
3246		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
3247		reg = (reg & ~0x000000ff) | 0x23;
3248		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
3249
3250		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
3251		reg = (reg & ~0x00000030) | 1 << 4;
3252		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
3253
3254		reg = urtwn_bb_read(sc, 0xe74);
3255		reg = (reg & ~0x0c000000) | 2 << 26;
3256		urtwn_bb_write(sc, 0xe74, reg);
3257		reg = urtwn_bb_read(sc, 0xe78);
3258		reg = (reg & ~0x0c000000) | 2 << 26;
3259		urtwn_bb_write(sc, 0xe78, reg);
3260		reg = urtwn_bb_read(sc, 0xe7c);
3261		reg = (reg & ~0x0c000000) | 2 << 26;
3262		urtwn_bb_write(sc, 0xe7c, reg);
3263		reg = urtwn_bb_read(sc, 0xe80);
3264		reg = (reg & ~0x0c000000) | 2 << 26;
3265		urtwn_bb_write(sc, 0xe80, reg);
3266		reg = urtwn_bb_read(sc, 0xe88);
3267		reg = (reg & ~0x0c000000) | 2 << 26;
3268		urtwn_bb_write(sc, 0xe88, reg);
3269	}
3270
3271	/* Write AGC values. */
3272	for (i = 0; i < prog->agccount; i++) {
3273		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
3274		    prog->agcvals[i]);
3275		urtwn_ms_delay(sc);
3276	}
3277
3278	if (sc->chip & URTWN_CHIP_88E) {
3279		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
3280		urtwn_ms_delay(sc);
3281		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
3282		urtwn_ms_delay(sc);
3283
3284		crystalcap = sc->rom.r88e_rom[0xb9];
3285		if (crystalcap == 0xff)
3286			crystalcap = 0x20;
3287		crystalcap &= 0x3f;
3288		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
3289		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
3290		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
3291		    crystalcap | crystalcap << 6));
3292	} else {
3293		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
3294		    R92C_HSSI_PARAM2_CCK_HIPWR)
3295			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
3296	}
3297}
3298
3299static void
3300urtwn_rf_init(struct urtwn_softc *sc)
3301{
3302	const struct urtwn_rf_prog *prog;
3303	uint32_t reg, type;
3304	int i, j, idx, off;
3305
3306	/* Select RF programming based on board type. */
3307	if (sc->chip & URTWN_CHIP_88E)
3308		prog = rtl8188eu_rf_prog;
3309	else if (!(sc->chip & URTWN_CHIP_92C)) {
3310		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
3311			prog = rtl8188ce_rf_prog;
3312		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
3313			prog = rtl8188ru_rf_prog;
3314		else
3315			prog = rtl8188cu_rf_prog;
3316	} else
3317		prog = rtl8192ce_rf_prog;
3318
3319	for (i = 0; i < sc->nrxchains; i++) {
3320		/* Save RF_ENV control type. */
3321		idx = i / 2;
3322		off = (i % 2) * 16;
3323		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
3324		type = (reg >> off) & 0x10;
3325
3326		/* Set RF_ENV enable. */
3327		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
3328		reg |= 0x100000;
3329		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
3330		urtwn_ms_delay(sc);
3331		/* Set RF_ENV output high. */
3332		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
3333		reg |= 0x10;
3334		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
3335		urtwn_ms_delay(sc);
3336		/* Set address and data lengths of RF registers. */
3337		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
3338		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
3339		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
3340		urtwn_ms_delay(sc);
3341		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
3342		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
3343		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
3344		urtwn_ms_delay(sc);
3345
3346		/* Write RF initialization values for this chain. */
3347		for (j = 0; j < prog[i].count; j++) {
3348			if (prog[i].regs[j] >= 0xf9 &&
3349			    prog[i].regs[j] <= 0xfe) {
3350				/*
3351				 * These are fake RF registers offsets that
3352				 * indicate a delay is required.
3353				 */
3354				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
3355				continue;
3356			}
3357			urtwn_rf_write(sc, i, prog[i].regs[j],
3358			    prog[i].vals[j]);
3359			urtwn_ms_delay(sc);
3360		}
3361
3362		/* Restore RF_ENV control type. */
3363		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
3364		reg &= ~(0x10 << off) | (type << off);
3365		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
3366
3367		/* Cache RF register CHNLBW. */
3368		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
3369	}
3370
3371	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
3372	    URTWN_CHIP_UMC_A_CUT) {
3373		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
3374		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
3375	}
3376}
3377
3378static void
3379urtwn_cam_init(struct urtwn_softc *sc)
3380{
3381	/* Invalidate all CAM entries. */
3382	urtwn_write_4(sc, R92C_CAMCMD,
3383	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
3384}
3385
3386static void
3387urtwn_pa_bias_init(struct urtwn_softc *sc)
3388{
3389	uint8_t reg;
3390	int i;
3391
3392	for (i = 0; i < sc->nrxchains; i++) {
3393		if (sc->pa_setting & (1 << i))
3394			continue;
3395		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
3396		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
3397		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
3398		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
3399	}
3400	if (!(sc->pa_setting & 0x10)) {
3401		reg = urtwn_read_1(sc, 0x16);
3402		reg = (reg & ~0xf0) | 0x90;
3403		urtwn_write_1(sc, 0x16, reg);
3404	}
3405}
3406
3407static void
3408urtwn_rxfilter_init(struct urtwn_softc *sc)
3409{
3410	struct ieee80211com *ic = &sc->sc_ic;
3411	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3412	uint32_t rcr;
3413	uint16_t filter;
3414
3415	URTWN_ASSERT_LOCKED(sc);
3416
3417	/* Accept all multicast frames. */
3418	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
3419	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
3420
3421	/* Filter for management frames. */
3422	filter = 0x7f3f;
3423	switch (vap->iv_opmode) {
3424	case IEEE80211_M_STA:
3425		filter &= ~(
3426		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_REQ) |
3427		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_REQ) |
3428		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_PROBE_REQ));
3429		break;
3430	case IEEE80211_M_HOSTAP:
3431		filter &= ~(
3432		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_RESP) |
3433		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_RESP) |
3434		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_BEACON));
3435		break;
3436	case IEEE80211_M_MONITOR:
3437	case IEEE80211_M_IBSS:
3438		break;
3439	default:
3440		device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
3441		    __func__, vap->iv_opmode);
3442		break;
3443	}
3444	urtwn_write_2(sc, R92C_RXFLTMAP0, filter);
3445
3446	/* Reject all control frames. */
3447	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
3448
3449	/* Reject all data frames. */
3450	urtwn_write_2(sc, R92C_RXFLTMAP2, 0x0000);
3451
3452	rcr = R92C_RCR_AM | R92C_RCR_AB | R92C_RCR_APM |
3453	      R92C_RCR_HTC_LOC_CTRL | R92C_RCR_APP_PHYSTS |
3454	      R92C_RCR_APP_ICV | R92C_RCR_APP_MIC;
3455
3456	if (vap->iv_opmode == IEEE80211_M_MONITOR) {
3457		/* Accept all frames. */
3458		rcr |= R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF |
3459		       R92C_RCR_AAP;
3460	}
3461
3462	/* Set Rx filter. */
3463	urtwn_write_4(sc, R92C_RCR, rcr);
3464
3465	if (ic->ic_promisc != 0) {
3466		/* Update Rx filter. */
3467		urtwn_set_promisc(sc);
3468	}
3469}
3470
3471static void
3472urtwn_edca_init(struct urtwn_softc *sc)
3473{
3474	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
3475	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
3476	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
3477	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
3478	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
3479	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
3480	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
3481	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
3482}
3483
3484static void
3485urtwn_write_txpower(struct urtwn_softc *sc, int chain,
3486    uint16_t power[URTWN_RIDX_COUNT])
3487{
3488	uint32_t reg;
3489
3490	/* Write per-CCK rate Tx power. */
3491	if (chain == 0) {
3492		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
3493		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
3494		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
3495		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
3496		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
3497		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
3498		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
3499		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
3500	} else {
3501		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
3502		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
3503		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
3504		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
3505		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
3506		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
3507		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
3508		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
3509	}
3510	/* Write per-OFDM rate Tx power. */
3511	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
3512	    SM(R92C_TXAGC_RATE06, power[ 4]) |
3513	    SM(R92C_TXAGC_RATE09, power[ 5]) |
3514	    SM(R92C_TXAGC_RATE12, power[ 6]) |
3515	    SM(R92C_TXAGC_RATE18, power[ 7]));
3516	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
3517	    SM(R92C_TXAGC_RATE24, power[ 8]) |
3518	    SM(R92C_TXAGC_RATE36, power[ 9]) |
3519	    SM(R92C_TXAGC_RATE48, power[10]) |
3520	    SM(R92C_TXAGC_RATE54, power[11]));
3521	/* Write per-MCS Tx power. */
3522	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
3523	    SM(R92C_TXAGC_MCS00,  power[12]) |
3524	    SM(R92C_TXAGC_MCS01,  power[13]) |
3525	    SM(R92C_TXAGC_MCS02,  power[14]) |
3526	    SM(R92C_TXAGC_MCS03,  power[15]));
3527	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
3528	    SM(R92C_TXAGC_MCS04,  power[16]) |
3529	    SM(R92C_TXAGC_MCS05,  power[17]) |
3530	    SM(R92C_TXAGC_MCS06,  power[18]) |
3531	    SM(R92C_TXAGC_MCS07,  power[19]));
3532	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
3533	    SM(R92C_TXAGC_MCS08,  power[20]) |
3534	    SM(R92C_TXAGC_MCS09,  power[21]) |
3535	    SM(R92C_TXAGC_MCS10,  power[22]) |
3536	    SM(R92C_TXAGC_MCS11,  power[23]));
3537	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
3538	    SM(R92C_TXAGC_MCS12,  power[24]) |
3539	    SM(R92C_TXAGC_MCS13,  power[25]) |
3540	    SM(R92C_TXAGC_MCS14,  power[26]) |
3541	    SM(R92C_TXAGC_MCS15,  power[27]));
3542}
3543
3544static void
3545urtwn_get_txpower(struct urtwn_softc *sc, int chain,
3546    struct ieee80211_channel *c, struct ieee80211_channel *extc,
3547    uint16_t power[URTWN_RIDX_COUNT])
3548{
3549	struct ieee80211com *ic = &sc->sc_ic;
3550	struct r92c_rom *rom = &sc->rom.r92c_rom;
3551	uint16_t cckpow, ofdmpow, htpow, diff, max;
3552	const struct urtwn_txpwr *base;
3553	int ridx, chan, group;
3554
3555	/* Determine channel group. */
3556	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3557	if (chan <= 3)
3558		group = 0;
3559	else if (chan <= 9)
3560		group = 1;
3561	else
3562		group = 2;
3563
3564	/* Get original Tx power based on board type and RF chain. */
3565	if (!(sc->chip & URTWN_CHIP_92C)) {
3566		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
3567			base = &rtl8188ru_txagc[chain];
3568		else
3569			base = &rtl8192cu_txagc[chain];
3570	} else
3571		base = &rtl8192cu_txagc[chain];
3572
3573	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3574	if (sc->regulatory == 0) {
3575		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
3576			power[ridx] = base->pwr[0][ridx];
3577	}
3578	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
3579		if (sc->regulatory == 3) {
3580			power[ridx] = base->pwr[0][ridx];
3581			/* Apply vendor limits. */
3582			if (extc != NULL)
3583				max = rom->ht40_max_pwr[group];
3584			else
3585				max = rom->ht20_max_pwr[group];
3586			max = (max >> (chain * 4)) & 0xf;
3587			if (power[ridx] > max)
3588				power[ridx] = max;
3589		} else if (sc->regulatory == 1) {
3590			if (extc == NULL)
3591				power[ridx] = base->pwr[group][ridx];
3592		} else if (sc->regulatory != 2)
3593			power[ridx] = base->pwr[0][ridx];
3594	}
3595
3596	/* Compute per-CCK rate Tx power. */
3597	cckpow = rom->cck_tx_pwr[chain][group];
3598	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
3599		power[ridx] += cckpow;
3600		if (power[ridx] > R92C_MAX_TX_PWR)
3601			power[ridx] = R92C_MAX_TX_PWR;
3602	}
3603
3604	htpow = rom->ht40_1s_tx_pwr[chain][group];
3605	if (sc->ntxchains > 1) {
3606		/* Apply reduction for 2 spatial streams. */
3607		diff = rom->ht40_2s_tx_pwr_diff[group];
3608		diff = (diff >> (chain * 4)) & 0xf;
3609		htpow = (htpow > diff) ? htpow - diff : 0;
3610	}
3611
3612	/* Compute per-OFDM rate Tx power. */
3613	diff = rom->ofdm_tx_pwr_diff[group];
3614	diff = (diff >> (chain * 4)) & 0xf;
3615	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
3616	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
3617		power[ridx] += ofdmpow;
3618		if (power[ridx] > R92C_MAX_TX_PWR)
3619			power[ridx] = R92C_MAX_TX_PWR;
3620	}
3621
3622	/* Compute per-MCS Tx power. */
3623	if (extc == NULL) {
3624		diff = rom->ht20_tx_pwr_diff[group];
3625		diff = (diff >> (chain * 4)) & 0xf;
3626		htpow += diff;	/* HT40->HT20 correction. */
3627	}
3628	for (ridx = 12; ridx <= 27; ridx++) {
3629		power[ridx] += htpow;
3630		if (power[ridx] > R92C_MAX_TX_PWR)
3631			power[ridx] = R92C_MAX_TX_PWR;
3632	}
3633#ifdef URTWN_DEBUG
3634	if (urtwn_debug >= 4) {
3635		/* Dump per-rate Tx power values. */
3636		printf("Tx power for chain %d:\n", chain);
3637		for (ridx = URTWN_RIDX_CCK1; ridx < URTWN_RIDX_COUNT; ridx++)
3638			printf("Rate %d = %u\n", ridx, power[ridx]);
3639	}
3640#endif
3641}
3642
3643static void
3644urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
3645    struct ieee80211_channel *c, struct ieee80211_channel *extc,
3646    uint16_t power[URTWN_RIDX_COUNT])
3647{
3648	struct ieee80211com *ic = &sc->sc_ic;
3649	uint16_t cckpow, ofdmpow, bw20pow, htpow;
3650	const struct urtwn_r88e_txpwr *base;
3651	int ridx, chan, group;
3652
3653	/* Determine channel group. */
3654	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3655	if (chan <= 2)
3656		group = 0;
3657	else if (chan <= 5)
3658		group = 1;
3659	else if (chan <= 8)
3660		group = 2;
3661	else if (chan <= 11)
3662		group = 3;
3663	else if (chan <= 13)
3664		group = 4;
3665	else
3666		group = 5;
3667
3668	/* Get original Tx power based on board type and RF chain. */
3669	base = &rtl8188eu_txagc[chain];
3670
3671	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3672	if (sc->regulatory == 0) {
3673		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
3674			power[ridx] = base->pwr[0][ridx];
3675	}
3676	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
3677		if (sc->regulatory == 3)
3678			power[ridx] = base->pwr[0][ridx];
3679		else if (sc->regulatory == 1) {
3680			if (extc == NULL)
3681				power[ridx] = base->pwr[group][ridx];
3682		} else if (sc->regulatory != 2)
3683			power[ridx] = base->pwr[0][ridx];
3684	}
3685
3686	/* Compute per-CCK rate Tx power. */
3687	cckpow = sc->cck_tx_pwr[group];
3688	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
3689		power[ridx] += cckpow;
3690		if (power[ridx] > R92C_MAX_TX_PWR)
3691			power[ridx] = R92C_MAX_TX_PWR;
3692	}
3693
3694	htpow = sc->ht40_tx_pwr[group];
3695
3696	/* Compute per-OFDM rate Tx power. */
3697	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
3698	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
3699		power[ridx] += ofdmpow;
3700		if (power[ridx] > R92C_MAX_TX_PWR)
3701			power[ridx] = R92C_MAX_TX_PWR;
3702	}
3703
3704	bw20pow = htpow + sc->bw20_tx_pwr_diff;
3705	for (ridx = 12; ridx <= 27; ridx++) {
3706		power[ridx] += bw20pow;
3707		if (power[ridx] > R92C_MAX_TX_PWR)
3708			power[ridx] = R92C_MAX_TX_PWR;
3709	}
3710}
3711
3712static void
3713urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
3714    struct ieee80211_channel *extc)
3715{
3716	uint16_t power[URTWN_RIDX_COUNT];
3717	int i;
3718
3719	for (i = 0; i < sc->ntxchains; i++) {
3720		/* Compute per-rate Tx power values. */
3721		if (sc->chip & URTWN_CHIP_88E)
3722			urtwn_r88e_get_txpower(sc, i, c, extc, power);
3723		else
3724			urtwn_get_txpower(sc, i, c, extc, power);
3725		/* Write per-rate Tx power values to hardware. */
3726		urtwn_write_txpower(sc, i, power);
3727	}
3728}
3729
3730static void
3731urtwn_set_rx_bssid_all(struct urtwn_softc *sc, int enable)
3732{
3733	uint32_t reg;
3734
3735	reg = urtwn_read_4(sc, R92C_RCR);
3736	if (enable)
3737		reg &= ~R92C_RCR_CBSSID_BCN;
3738	else
3739		reg |= R92C_RCR_CBSSID_BCN;
3740	urtwn_write_4(sc, R92C_RCR, reg);
3741}
3742
3743static void
3744urtwn_set_gain(struct urtwn_softc *sc, uint8_t gain)
3745{
3746	uint32_t reg;
3747
3748	reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
3749	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
3750	urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
3751
3752	if (!(sc->chip & URTWN_CHIP_88E)) {
3753		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
3754		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
3755		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
3756	}
3757}
3758
3759static void
3760urtwn_scan_start(struct ieee80211com *ic)
3761{
3762	struct urtwn_softc *sc = ic->ic_softc;
3763
3764	URTWN_LOCK(sc);
3765	/* Receive beacons / probe responses from any BSSID. */
3766	if (ic->ic_opmode != IEEE80211_M_IBSS)
3767		urtwn_set_rx_bssid_all(sc, 1);
3768
3769	/* Set gain for scanning. */
3770	urtwn_set_gain(sc, 0x20);
3771	URTWN_UNLOCK(sc);
3772}
3773
3774static void
3775urtwn_scan_end(struct ieee80211com *ic)
3776{
3777	struct urtwn_softc *sc = ic->ic_softc;
3778
3779	URTWN_LOCK(sc);
3780	/* Restore limitations. */
3781	if (ic->ic_promisc == 0 && ic->ic_opmode != IEEE80211_M_IBSS)
3782		urtwn_set_rx_bssid_all(sc, 0);
3783
3784	/* Set gain under link. */
3785	urtwn_set_gain(sc, 0x32);
3786	URTWN_UNLOCK(sc);
3787}
3788
3789static void
3790urtwn_set_channel(struct ieee80211com *ic)
3791{
3792	struct urtwn_softc *sc = ic->ic_softc;
3793	struct ieee80211_channel *c = ic->ic_curchan;
3794	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3795
3796	URTWN_LOCK(sc);
3797	if (vap->iv_state == IEEE80211_S_SCAN) {
3798		/* Make link LED blink during scan. */
3799		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
3800	}
3801	urtwn_set_chan(sc, c, NULL);
3802	sc->sc_rxtap.wr_chan_freq = htole16(c->ic_freq);
3803	sc->sc_rxtap.wr_chan_flags = htole16(c->ic_flags);
3804	sc->sc_txtap.wt_chan_freq = htole16(c->ic_freq);
3805	sc->sc_txtap.wt_chan_flags = htole16(c->ic_flags);
3806	URTWN_UNLOCK(sc);
3807}
3808
3809static int
3810urtwn_wme_update(struct ieee80211com *ic)
3811{
3812	const struct wmeParams *wmep =
3813	    ic->ic_wme.wme_chanParams.cap_wmeParams;
3814	struct urtwn_softc *sc = ic->ic_softc;
3815	uint8_t aifs, acm, slottime;
3816	int ac;
3817
3818	acm = 0;
3819	slottime = IEEE80211_GET_SLOTTIME(ic);
3820
3821	URTWN_LOCK(sc);
3822	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
3823		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
3824		aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
3825		urtwn_write_4(sc, wme2queue[ac].reg,
3826		    SM(R92C_EDCA_PARAM_TXOP, wmep[ac].wmep_txopLimit) |
3827		    SM(R92C_EDCA_PARAM_ECWMIN, wmep[ac].wmep_logcwmin) |
3828		    SM(R92C_EDCA_PARAM_ECWMAX, wmep[ac].wmep_logcwmax) |
3829		    SM(R92C_EDCA_PARAM_AIFS, aifs));
3830		if (ac != WME_AC_BE)
3831			acm |= wmep[ac].wmep_acm << ac;
3832	}
3833
3834	if (acm != 0)
3835		acm |= R92C_ACMHWCTRL_EN;
3836	urtwn_write_1(sc, R92C_ACMHWCTRL,
3837	    (urtwn_read_1(sc, R92C_ACMHWCTRL) & ~R92C_ACMHWCTRL_ACM_MASK) |
3838	    acm);
3839
3840	URTWN_UNLOCK(sc);
3841
3842	return 0;
3843}
3844
3845static void
3846urtwn_set_promisc(struct urtwn_softc *sc)
3847{
3848	struct ieee80211com *ic = &sc->sc_ic;
3849	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3850	uint32_t rcr, mask1, mask2;
3851
3852	URTWN_ASSERT_LOCKED(sc);
3853
3854	if (vap->iv_opmode == IEEE80211_M_MONITOR)
3855		return;
3856
3857	mask1 = R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF | R92C_RCR_AAP;
3858	mask2 = R92C_RCR_APM;
3859
3860	if (vap->iv_state == IEEE80211_S_RUN) {
3861		switch (vap->iv_opmode) {
3862		case IEEE80211_M_STA:
3863			mask2 |= R92C_RCR_CBSSID_DATA;
3864			/* FALLTHROUGH */
3865		case IEEE80211_M_HOSTAP:
3866			mask2 |= R92C_RCR_CBSSID_BCN;
3867			break;
3868		case IEEE80211_M_IBSS:
3869			mask2 |= R92C_RCR_CBSSID_DATA;
3870			break;
3871		default:
3872			device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
3873			    __func__, vap->iv_opmode);
3874			return;
3875		}
3876	}
3877
3878	rcr = urtwn_read_4(sc, R92C_RCR);
3879	if (ic->ic_promisc == 0)
3880		rcr = (rcr & ~mask1) | mask2;
3881	else
3882		rcr = (rcr & ~mask2) | mask1;
3883	urtwn_write_4(sc, R92C_RCR, rcr);
3884}
3885
3886static void
3887urtwn_update_promisc(struct ieee80211com *ic)
3888{
3889	struct urtwn_softc *sc = ic->ic_softc;
3890
3891	URTWN_LOCK(sc);
3892	if (sc->sc_flags & URTWN_RUNNING)
3893		urtwn_set_promisc(sc);
3894	URTWN_UNLOCK(sc);
3895}
3896
3897static void
3898urtwn_update_mcast(struct ieee80211com *ic)
3899{
3900	/* XXX do nothing?  */
3901}
3902
3903static struct ieee80211_node *
3904urtwn_r88e_node_alloc(struct ieee80211vap *vap,
3905    const uint8_t mac[IEEE80211_ADDR_LEN])
3906{
3907	struct urtwn_node *un;
3908
3909	un = malloc(sizeof (struct urtwn_node), M_80211_NODE,
3910	    M_NOWAIT | M_ZERO);
3911
3912	if (un == NULL)
3913		return NULL;
3914
3915	un->id = URTWN_MACID_UNDEFINED;
3916
3917	return &un->ni;
3918}
3919
3920static void
3921urtwn_r88e_newassoc(struct ieee80211_node *ni, int isnew)
3922{
3923	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
3924	struct urtwn_node *un = URTWN_NODE(ni);
3925	uint8_t id;
3926
3927	if (!isnew)
3928		return;
3929
3930	URTWN_NT_LOCK(sc);
3931	for (id = 0; id <= URTWN_MACID_MAX(sc); id++) {
3932		if (id != URTWN_MACID_BC && sc->node_list[id] == NULL) {
3933			un->id = id;
3934			sc->node_list[id] = ni;
3935			break;
3936		}
3937	}
3938	URTWN_NT_UNLOCK(sc);
3939
3940	if (id > URTWN_MACID_MAX(sc)) {
3941		device_printf(sc->sc_dev, "%s: node table is full\n",
3942		    __func__);
3943	}
3944}
3945
3946static void
3947urtwn_r88e_node_free(struct ieee80211_node *ni)
3948{
3949	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
3950	struct urtwn_node *un = URTWN_NODE(ni);
3951
3952	URTWN_NT_LOCK(sc);
3953	if (un->id != URTWN_MACID_UNDEFINED)
3954		sc->node_list[un->id] = NULL;
3955	URTWN_NT_UNLOCK(sc);
3956
3957	sc->sc_node_free(ni);
3958}
3959
3960static void
3961urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
3962    struct ieee80211_channel *extc)
3963{
3964	struct ieee80211com *ic = &sc->sc_ic;
3965	uint32_t reg;
3966	u_int chan;
3967	int i;
3968
3969	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3970	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
3971		device_printf(sc->sc_dev,
3972		    "%s: invalid channel %x\n", __func__, chan);
3973		return;
3974	}
3975
3976	/* Set Tx power for this new channel. */
3977	urtwn_set_txpower(sc, c, extc);
3978
3979	for (i = 0; i < sc->nrxchains; i++) {
3980		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
3981		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
3982	}
3983#ifndef IEEE80211_NO_HT
3984	if (extc != NULL) {
3985		/* Is secondary channel below or above primary? */
3986		int prichlo = c->ic_freq < extc->ic_freq;
3987
3988		urtwn_write_1(sc, R92C_BWOPMODE,
3989		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
3990
3991		reg = urtwn_read_1(sc, R92C_RRSR + 2);
3992		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
3993		urtwn_write_1(sc, R92C_RRSR + 2, reg);
3994
3995		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3996		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
3997		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3998		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
3999
4000		/* Set CCK side band. */
4001		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
4002		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
4003		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
4004
4005		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
4006		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
4007		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
4008
4009		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
4010		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
4011		    ~R92C_FPGA0_ANAPARAM2_CBW20);
4012
4013		reg = urtwn_bb_read(sc, 0x818);
4014		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
4015		urtwn_bb_write(sc, 0x818, reg);
4016
4017		/* Select 40MHz bandwidth. */
4018		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
4019		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
4020	} else
4021#endif
4022	{
4023		urtwn_write_1(sc, R92C_BWOPMODE,
4024		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
4025
4026		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
4027		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
4028		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
4029		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
4030
4031		if (!(sc->chip & URTWN_CHIP_88E)) {
4032			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
4033			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
4034			    R92C_FPGA0_ANAPARAM2_CBW20);
4035		}
4036
4037		/* Select 20MHz bandwidth. */
4038		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
4039		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
4040		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
4041		    R92C_RF_CHNLBW_BW20));
4042	}
4043}
4044
4045static void
4046urtwn_iq_calib(struct urtwn_softc *sc)
4047{
4048	/* TODO */
4049}
4050
4051static void
4052urtwn_lc_calib(struct urtwn_softc *sc)
4053{
4054	uint32_t rf_ac[2];
4055	uint8_t txmode;
4056	int i;
4057
4058	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
4059	if ((txmode & 0x70) != 0) {
4060		/* Disable all continuous Tx. */
4061		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
4062
4063		/* Set RF mode to standby mode. */
4064		for (i = 0; i < sc->nrxchains; i++) {
4065			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
4066			urtwn_rf_write(sc, i, R92C_RF_AC,
4067			    RW(rf_ac[i], R92C_RF_AC_MODE,
4068				R92C_RF_AC_MODE_STANDBY));
4069		}
4070	} else {
4071		/* Block all Tx queues. */
4072		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
4073	}
4074	/* Start calibration. */
4075	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
4076	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
4077
4078	/* Give calibration the time to complete. */
4079	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
4080
4081	/* Restore configuration. */
4082	if ((txmode & 0x70) != 0) {
4083		/* Restore Tx mode. */
4084		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
4085		/* Restore RF mode. */
4086		for (i = 0; i < sc->nrxchains; i++)
4087			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
4088	} else {
4089		/* Unblock all Tx queues. */
4090		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
4091	}
4092}
4093
4094static int
4095urtwn_init(struct urtwn_softc *sc)
4096{
4097	struct ieee80211com *ic = &sc->sc_ic;
4098	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4099	uint8_t macaddr[IEEE80211_ADDR_LEN];
4100	uint32_t reg;
4101	usb_error_t usb_err = USB_ERR_NORMAL_COMPLETION;
4102	int error;
4103
4104	URTWN_LOCK(sc);
4105	if (sc->sc_flags & URTWN_RUNNING) {
4106		URTWN_UNLOCK(sc);
4107		return (0);
4108	}
4109
4110	/* Init firmware commands ring. */
4111	sc->fwcur = 0;
4112
4113	/* Allocate Tx/Rx buffers. */
4114	error = urtwn_alloc_rx_list(sc);
4115	if (error != 0)
4116		goto fail;
4117
4118	error = urtwn_alloc_tx_list(sc);
4119	if (error != 0)
4120		goto fail;
4121
4122	/* Power on adapter. */
4123	error = urtwn_power_on(sc);
4124	if (error != 0)
4125		goto fail;
4126
4127	/* Initialize DMA. */
4128	error = urtwn_dma_init(sc);
4129	if (error != 0)
4130		goto fail;
4131
4132	/* Set info size in Rx descriptors (in 64-bit words). */
4133	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
4134
4135	/* Init interrupts. */
4136	if (sc->chip & URTWN_CHIP_88E) {
4137		usb_err = urtwn_write_4(sc, R88E_HISR, 0xffffffff);
4138		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4139			goto fail;
4140		usb_err = urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
4141		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
4142		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4143			goto fail;
4144		usb_err = urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
4145		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
4146		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4147			goto fail;
4148		usb_err = urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
4149		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
4150		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
4151		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4152			goto fail;
4153	} else {
4154		usb_err = urtwn_write_4(sc, R92C_HISR, 0xffffffff);
4155		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4156			goto fail;
4157		usb_err = urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
4158		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4159			goto fail;
4160	}
4161
4162	/* Set MAC address. */
4163	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
4164	usb_err = urtwn_write_region_1(sc, R92C_MACID, macaddr, IEEE80211_ADDR_LEN);
4165	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4166		goto fail;
4167
4168	/* Set initial network type. */
4169	urtwn_set_mode(sc, R92C_MSR_INFRA);
4170
4171	/* Initialize Rx filter. */
4172	urtwn_rxfilter_init(sc);
4173
4174	/* Set response rate. */
4175	reg = urtwn_read_4(sc, R92C_RRSR);
4176	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
4177	urtwn_write_4(sc, R92C_RRSR, reg);
4178
4179	/* Set short/long retry limits. */
4180	urtwn_write_2(sc, R92C_RL,
4181	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
4182
4183	/* Initialize EDCA parameters. */
4184	urtwn_edca_init(sc);
4185
4186	/* Setup rate fallback. */
4187	if (!(sc->chip & URTWN_CHIP_88E)) {
4188		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
4189		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
4190		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
4191		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
4192	}
4193
4194	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
4195	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
4196	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
4197	/* Set ACK timeout. */
4198	urtwn_write_1(sc, R92C_ACKTO, 0x40);
4199
4200	/* Setup USB aggregation. */
4201	reg = urtwn_read_4(sc, R92C_TDECTRL);
4202	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
4203	urtwn_write_4(sc, R92C_TDECTRL, reg);
4204	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
4205	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
4206	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
4207	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
4208	if (sc->chip & URTWN_CHIP_88E)
4209		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
4210	else {
4211		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
4212		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
4213		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
4214		    R92C_USB_SPECIAL_OPTION_AGG_EN);
4215		urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
4216		urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
4217	}
4218
4219	/* Initialize beacon parameters. */
4220	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
4221	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
4222	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
4223	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
4224	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
4225
4226	if (!(sc->chip & URTWN_CHIP_88E)) {
4227		/* Setup AMPDU aggregation. */
4228		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
4229		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
4230		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
4231
4232		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
4233	}
4234
4235	/* Load 8051 microcode. */
4236	error = urtwn_load_firmware(sc);
4237	if (error != 0)
4238		goto fail;
4239
4240	/* Initialize MAC/BB/RF blocks. */
4241	error = urtwn_mac_init(sc);
4242	if (error != 0) {
4243		device_printf(sc->sc_dev,
4244		    "%s: error while initializing MAC block\n", __func__);
4245		goto fail;
4246	}
4247	urtwn_bb_init(sc);
4248	urtwn_rf_init(sc);
4249
4250	/* Reinitialize Rx filter (D3845 is not committed yet). */
4251	urtwn_rxfilter_init(sc);
4252
4253	if (sc->chip & URTWN_CHIP_88E) {
4254		urtwn_write_2(sc, R92C_CR,
4255		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
4256		    R92C_CR_MACRXEN);
4257	}
4258
4259	/* Turn CCK and OFDM blocks on. */
4260	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
4261	reg |= R92C_RFMOD_CCK_EN;
4262	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
4263	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4264		goto fail;
4265	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
4266	reg |= R92C_RFMOD_OFDM_EN;
4267	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
4268	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4269		goto fail;
4270
4271	/* Clear per-station keys table. */
4272	urtwn_cam_init(sc);
4273
4274	/* Enable hardware sequence numbering. */
4275	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
4276
4277	/* Enable per-packet TX report. */
4278	if (sc->chip & URTWN_CHIP_88E) {
4279		urtwn_write_1(sc, R88E_TX_RPT_CTRL,
4280		    urtwn_read_1(sc, R88E_TX_RPT_CTRL) | R88E_TX_RPT1_ENA);
4281	}
4282
4283	/* Perform LO and IQ calibrations. */
4284	urtwn_iq_calib(sc);
4285	/* Perform LC calibration. */
4286	urtwn_lc_calib(sc);
4287
4288	/* Fix USB interference issue. */
4289	if (!(sc->chip & URTWN_CHIP_88E)) {
4290		urtwn_write_1(sc, 0xfe40, 0xe0);
4291		urtwn_write_1(sc, 0xfe41, 0x8d);
4292		urtwn_write_1(sc, 0xfe42, 0x80);
4293
4294		urtwn_pa_bias_init(sc);
4295	}
4296
4297	/* Initialize GPIO setting. */
4298	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
4299	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
4300
4301	/* Fix for lower temperature. */
4302	if (!(sc->chip & URTWN_CHIP_88E))
4303		urtwn_write_1(sc, 0x15, 0xe9);
4304
4305	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
4306
4307	sc->sc_flags |= URTWN_RUNNING;
4308
4309	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
4310fail:
4311	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4312		error = EIO;
4313
4314	URTWN_UNLOCK(sc);
4315
4316	return (error);
4317}
4318
4319static void
4320urtwn_stop(struct urtwn_softc *sc)
4321{
4322
4323	URTWN_LOCK(sc);
4324	if (!(sc->sc_flags & URTWN_RUNNING)) {
4325		URTWN_UNLOCK(sc);
4326		return;
4327	}
4328
4329	sc->sc_flags &= ~URTWN_RUNNING;
4330	callout_stop(&sc->sc_watchdog_ch);
4331	urtwn_abort_xfers(sc);
4332
4333	urtwn_drain_mbufq(sc);
4334	URTWN_UNLOCK(sc);
4335}
4336
4337static void
4338urtwn_abort_xfers(struct urtwn_softc *sc)
4339{
4340	int i;
4341
4342	URTWN_ASSERT_LOCKED(sc);
4343
4344	/* abort any pending transfers */
4345	for (i = 0; i < URTWN_N_TRANSFER; i++)
4346		usbd_transfer_stop(sc->sc_xfer[i]);
4347}
4348
4349static int
4350urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
4351    const struct ieee80211_bpf_params *params)
4352{
4353	struct ieee80211com *ic = ni->ni_ic;
4354	struct urtwn_softc *sc = ic->ic_softc;
4355	struct urtwn_data *bf;
4356	int error;
4357
4358	/* prevent management frames from being sent if we're not ready */
4359	URTWN_LOCK(sc);
4360	if (!(sc->sc_flags & URTWN_RUNNING)) {
4361		error = ENETDOWN;
4362		goto end;
4363	}
4364
4365	bf = urtwn_getbuf(sc);
4366	if (bf == NULL) {
4367		error = ENOBUFS;
4368		goto end;
4369	}
4370
4371	if ((error = urtwn_tx_data(sc, ni, m, bf)) != 0) {
4372		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
4373		goto end;
4374	}
4375
4376	sc->sc_txtimer = 5;
4377	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
4378
4379end:
4380	if (error != 0)
4381		m_freem(m);
4382
4383	URTWN_UNLOCK(sc);
4384
4385	return (error);
4386}
4387
4388static void
4389urtwn_ms_delay(struct urtwn_softc *sc)
4390{
4391	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
4392}
4393
4394static device_method_t urtwn_methods[] = {
4395	/* Device interface */
4396	DEVMETHOD(device_probe,		urtwn_match),
4397	DEVMETHOD(device_attach,	urtwn_attach),
4398	DEVMETHOD(device_detach,	urtwn_detach),
4399
4400	DEVMETHOD_END
4401};
4402
4403static driver_t urtwn_driver = {
4404	"urtwn",
4405	urtwn_methods,
4406	sizeof(struct urtwn_softc)
4407};
4408
4409static devclass_t urtwn_devclass;
4410
4411DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
4412MODULE_DEPEND(urtwn, usb, 1, 1, 1);
4413MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
4414MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
4415MODULE_VERSION(urtwn, 1);
4416USB_PNP_HOST_INFO(urtwn_devs);
4417